CVE-2022-24716CWE-22

Path traversal in Icinga Web 2

High · published March 8, 2022

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.8th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

89%

Percentile

99.8

In the wild

Unconfirmed

What it is

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.89378 · 99.8th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2022-03-08T00:00Z

EPSS history

Timeline

08 MAR 00:00Z
Path traversal in Icinga Web 2
cvelistv5