VDB
CVE-2022-24715
CVE-2022-24715
PUBLISHED
CVSS 8.5 HIGH
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.
EPSS 14.46% · 96.6th percentile
Risk Scores
CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score
14.46%
96.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Icinga | icingaweb2 | < 2.8.6, * |
| icinga | icinga_web_2 | 0, 2.9.0 |
Timeline
- Mar 8, 2022 CVE Published
- Mar 9, 2022 EPSS Score
- Apr 30, 2022 EPSS Score
- Jun 20, 2022 EPSS Score
- Aug 12, 2022 EPSS Score
- Nov 23, 2022 EPSS Score
- Jan 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Jun 17, 2023 EPSS Score
- Jul 15, 2023 PoC Published
- Aug 8, 2023 EPSS Score
- Nov 19, 2023 EPSS Score
References
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63 url
- https://security.gentoo.org/glsa/202208-05 advisory
- https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb fix
- http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html exploit