CVE-2022-24716
Published: 08 March 2022
Summary
CVE-2022-24716 is a high-severity Path Traversal (CWE-22) vulnerability in Icinga Icinga Web 2. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Icinga Web 2, an open source monitoring web interface, framework, and command-line tool, contains a path traversal vulnerability (CVE-2022-24716, CWE-22) that permits unauthenticated remote attackers to read arbitrary files on the local system that are accessible to the web-server process. The flaw affects versions prior to 2.9.6 and 2.10 and carries a CVSS 3.1 score of 7.5, reflecting network attackability without credentials or user interaction and a high impact on confidentiality through disclosure of files such as Icinga Web 2 configuration data containing database credentials.
An unauthenticated attacker can send crafted requests to the web interface to retrieve sensitive local files, thereby obtaining database credentials and other configuration secrets that may enable further compromise of the monitoring environment or connected systems.
The vulnerability was addressed in Icinga Web 2 releases 2.9.6 and 2.10, with the project advisory and associated commit detailing the fix; database credentials should be rotated after applying the update. Public exploit code has been published, and the CVE maintains a high EPSS score with a current value of 0.9255 and a recorded peak of 0.9338.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29577
Vulnerability details
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue…
more
has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.