CVE-2022-24715 - OpenCVE

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Icinga	Icinga Web 2

Configuration 1 [-]

OR	cpe:2.3:a:icinga:icinga_web_2::::::::
	cpe:2.3:a:icinga:icinga_web_2::::::::

References

Link	Resource
http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html
https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb	Patch Third Party Advisory
https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63	Third Party Advisory
https://security.gentoo.org/glsa/202208-05	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-03-08T00:00:00

Updated: 2023-07-17T00:00:00

Reserved: 2022-02-10T00:00:00

Link: CVE-2022-24715

JSON object: View

NVD Information

Status : Modified

Published: 2022-03-08T20:15:07.777

Modified: 2023-07-17T17:15:09.443

Link: CVE-2022-24715

JSON object: View

Redhat Information

No data.

CWE

CWE-22

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*", "matchCriteriaId": "31515B3D-01CA-4B3C-AF94-AD63FDE7F8B7", "versionEndExcluding": "2.8.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE7D185F-C8C8-4401-B8F5-580DF83D5D79", "versionEndExcluding": "2.9.6", "versionStartIncluding": "2.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration."}, {"lang": "es", "value": "Icinga Web 2 es una interfaz web de monitorizaci\u00f3n de c\u00f3digo abierto, un framework y una interfaz de l\u00ednea de comandos. Los usuarios autenticados, con acceso a la configuraci\u00f3n, pueden crear archivos de recursos SSH en directorios no deseados, conllevando a una ejecuci\u00f3n de c\u00f3digo arbitrario. Este problema ha sido resuelto en las versiones 2.8.6, 2.9.6 y 2.10 de Icinga Web 2. Los usuarios que no puedan actualizarse deber\u00e1n limitar el acceso a la configuraci\u00f3n de Icinga Web 2"}], "id": "CVE-2022-24715", "lastModified": "2023-07-17T17:15:09.443", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-03-08T20:15:07.777", "references": [{"source": "security-advisories@github.com", "url": "http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202208-05"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}]}