CVE-2022-24716
Path traversal in Icinga Web 2
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
6Exploited in Wild
-Decision
Descriptions
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
Icinga Web 2 es una interfaz web de monitorización de código abierto, un framework y una interfaz de línea de comandos. Los usuarios no autenticados pueden filtrar el contenido de los archivos del sistema local accesibles al usuario del servidor web, incluidos los archivos de configuración de `icingaweb2` con credenciales de la base de datos. Este problema se ha resuelto en las versiones 2.9.6 y 2.10 de Icinga Web 2. Las credenciales de la base de datos deben rotarse
Icinga Web version 2.10 suffers from an arbitrary file disclosure vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-02-10 CVE Reserved
- 2022-03-08 CVE Published
- 2023-03-26 First Exploit
- 2024-08-03 CVE Updated
- 2024-10-26 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (11)
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/51329 | 2023-04-08 | |
https://github.com/JacobEbben/CVE-2022-24716 | 2023-03-27 | |
https://github.com/joaoviictorti/CVE-2022-24716 | 2023-10-11 | |
https://github.com/doosec101/CVE-2022-24716 | 2023-03-27 | |
https://github.com/antisecc/CVE-2022-24716 | 2023-05-20 | |
https://github.com/pumpkinpiteam/CVE-2022-24716 | 2023-03-26 |
URL | Date | SRC |
---|---|---|
https://github.com/Icinga/icingaweb2/commit/9931ed799650f5b8d5e1dc58ea3415a4cdc5773d | 2022-05-09 |
URL | Date | SRC |
---|---|---|
https://security.gentoo.org/glsa/202208-05 | 2023-04-10 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Icinga Search vendor "Icinga" | Icinga Web 2 Search vendor "Icinga" for product "Icinga Web 2" | >= 2.9.0 < 2.9.6 Search vendor "Icinga" for product "Icinga Web 2" and version " >= 2.9.0 < 2.9.6" | - |
Affected
|