CVE-2022-24715 in the critical feed json
Arbitrary code execution for authenticated users in Icinga Web 2
published 2022-03-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-29576
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.9%
- EPSS 14.9% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.
Patch / fix
- icinga icinga_web_2 2.8.6, 2.9.6
- icingaweb2 Debian 14, Debian 13, Debian 12 2.9.6-1
debian advisories DEBIAN-CVE-2022-24715
- icingaweb2 Package Hub 15 SP3, openSUSE Leap 15.3 2.8.6-bp153.2.3.1
- icingaweb2 Package Hub 12 2.8.6-15.1
opensuse advisories openSUSE-SU-2022:0097-1openSUSE-SU-2022:0087-1
Timeline
- Published
- First public exploit (EDB-51586)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
14.94% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-51586 Icinga Web 2.10 - Authenticated Remote Code Execution webapps, 2023-07-15
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Affected products
- Icinga icingaweb2
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb
patch, third-party-advisory
-
security.gentoo.org
/glsa/202208-05
vendor-advisory, third-party-advisory
-
github.com
/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63
third-party-advisory
- packetstormsecurity.com /files/173516/Icinga-Web-2.10-Remote-Code-Execution.html
Sources
- CVE List CVE-2022-24715
- NVD CVE-2022-24715
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.