Published: 08/03/2022 Updated: 17/07/2023

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 606

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

Vulnerable Product	Search on Vulmon	Subscribe to Product
icinga icinga web 2

#!/usr/bin/env python3 # Exploit Title: Icinga Web 210 - Authenticated Remote Code Execution # Date: 8/07/2023 # Exploit Author: Dante Corona(Aka cxdxnt) # Software Link: githubcom/Icinga/icingaweb2 # Vendor Homepage: icingacom/ # Software Link: githubcom/Icinga/icingaweb2 # Version: <286, <296, <210 # T ...

Icinga Web version 210 suffers from an authenticated remote code execution vulnerability ...

CVE-2022-24715 The Icinga Web 2 exploit written in go The original python code can be found in: packetstormsecuritycom/files/173516/Icinga-Web-210-Remote-Code-Executionhtml

Authenticated Remote Code Execution in Icinga Web 2 <2.8.6, <2.9.6, <2.10

CVE-2022-24715 Icinga Web 2 - Authenticated Remote Code Execution <286, <296, <210 DISCLAIMER: This script is made to audit the security of systems Only use this script on your own systems or on systems you have written permission to exploit

CWE-22 https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63 https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb https://security.gentoo.org/glsa/202208-05 http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html https://nvd.nist.gov https://github.com/d4rkb0n3/CVE-2022-24715-go https://github.com/JacobEbben/CVE-2022-24715 https://www.exploit-db.com/exploits/51586

CVE-2022-24715

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect