CVE-2022-24715

Deeper analysis

Icinga Web 2, an open source monitoring web interface and framework, contains a path traversal vulnerability (CWE-22) that permits authenticated users with configuration access to create SSH resource files in arbitrary directories. The flaw affects multiple releases prior to the patches and carries a CVSS 3.1 score of 8.5 reflecting high impact across confidentiality, integrity, and availability when successfully exploited.

An attacker who already possesses a valid account and configuration privileges can supply crafted paths that place attacker-controlled SSH resources outside intended locations, resulting in arbitrary code execution on the underlying host. The attack requires network access but no user interaction beyond the initial authenticated session.

Official advisories and the referenced GitHub security notice state that the issue is resolved in Icinga Web 2 versions 2.8.6, 2.9.6, and 2.10; the accompanying commit and Gentoo GLSA confirm the availability of these updates. Organizations unable to upgrade are advised to restrict access to the Icinga Web 2 configuration interface. Public proof-of-concept material has been posted to Packet Storm, and the current EPSS score of 0.7251 indicates sustained exploitation interest since disclosure.