VDB
CVE-2022-24714
CVE-2022-24714
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2.
EPSS 1.22% · 68.4th percentile
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
1.22%
68.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| icinga | icinga_web_2 | 0, 2.9.0 |
| Icinga | icingaweb2 | < 2.8.6, >= 2.9.0, < 2.9.6 |
Timeline
- Mar 8, 2022 CVE Published
- Mar 9, 2022 EPSS Score
- Apr 30, 2022 EPSS Score
- Jun 21, 2022 EPSS Score
- Aug 13, 2022 EPSS Score
- Oct 5, 2022 EPSS Score
- Nov 26, 2022 EPSS Score
- Jan 17, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 1, 2023 EPSS Score
- Jun 22, 2023 EPSS Score
- Aug 13, 2023 EPSS Score