CVE-2022-24715CWE-22

Arbitrary code execution for authenticated users in Icinga Web 2

High · published March 8, 2022

CVSS v3.1

8.5

EPSS

15%

Percentile

96.7

In the wild

Unconfirmed

What it is

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

The record

Technical detail

CVSS v3.1: 8.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.14670 · 96.7th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2022-03-08T00:00Z

EPSS history

Timeline

08 MAR 00:00Z
Arbitrary code execution for authenticated users in Icinga Web 2
cvelistv5