CVE-2018-18246: CSRF
Published Dec 17, 2018
·Updated
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.
Affected Software
1 affected component
Icinga Icinga Web 2<2.6.2
Event History
Dec 17, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-18246?
The severity of CVE-2018-18246 is medium with a CVSS score of 6.5.
2
How does CVE-2018-18246 affect Icinga Web 2?
CVE-2018-18246 affects all versions of Icinga Web 2 up to and excluding version 2.6.2.
3
What is the risk of CSRF via /icingaweb2/config/moduledisable?name=monitoring?
CSRF via /icingaweb2/config/moduledisable?name=monitoring allows an attacker to disable the monitoring module of Icinga Web 2.
4
How can I enable the setup module in Icinga Web 2?
You can enable the setup module in Icinga Web 2 by using the /icingaweb2/config/moduleenable?name=setup URL.
5
How can I fix CVE-2018-18246?
To fix CVE-2018-18246, it is recommended to upgrade Icinga Web 2 to version 2.6.2 or later.