CVE-2022-24714

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2.

CVSS v3 5.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/Icinga/icingaweb2/commit/6e989d05a1568a6733a3d912001251acc51d9293	Patch Third Party Advisory
https://github.com/Icinga/icingaweb2/security/advisories/GHSA-qcmg-vr56-x9wf	Third Party Advisory
https://security.gentoo.org/glsa/202208-05	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:icinga:icinga_web_2::::::::
	cpe:2.3:a:icinga:icinga_web_2::::::::

History

No history.

Information

Published : 2022-03-08 20:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-24714

Mitre link : CVE-2022-24714

CVE.ORG link : CVE-2022-24714

JSON object : View

Products Affected

icinga

icinga_web_2

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2022-24714", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-03-08T20:15:07.697", "references": [{"url": "https://github.com/Icinga/icingaweb2/commit/6e989d05a1568a6733a3d912001251acc51d9293", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-qcmg-vr56-x9wf", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://security.gentoo.org/glsa/202208-05", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2."}, {"lang": "es", "value": "Icinga Web 2 es una interfaz web de monitorizaci\u00f3n de c\u00f3digo abierto, un framework y una interfaz de l\u00ednea de comandos. Las instalaciones de Icinga 2 con el escritor IDO activado est\u00e1n afectadas. Si se utilizan variables personalizadas de servicio en las restricciones de rol, y se desmantelan regularmente los objetos de servicio, los usuarios con dichos roles pueden seguir teniendo acceso a una colecci\u00f3n de contenido. Tenga en cuenta que esto s\u00f3lo se aplica si un rol tiene permitido impl\u00edcitamente el acceso a los hosts, debido al acceso permitido a al menos uno de sus servicios. Si se permite el acceso a un host por otros medios, no se ha revelado informaci\u00f3n sensible a usuarios no autorizados. Este problema ha sido resuelto en las versiones 2.8.6, 2.9.6 y 2.10 de Icinga Web 2"}], "lastModified": "2022-11-09T21:38:19.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31515B3D-01CA-4B3C-AF94-AD63FDE7F8B7", "versionEndExcluding": "2.8.6"}, {"criteria": "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE7D185F-C8C8-4401-B8F5-580DF83D5D79", "versionEndExcluding": "2.9.6", "versionStartIncluding": "2.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}