CVE-2022-24716: Path traversal in Icinga Web 2
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24716?
CVE-2022-24716 is a vulnerability in Icinga Web 2 that allows unauthenticated users to access and leak the contents of files on the local system, including configuration files with sensitive information.
What is the severity of CVE-2022-24716?
CVE-2022-24716 has a severity rating of 7.5 (High).
How does CVE-2022-24716 impact Icinga Web 2?
CVE-2022-24716 allows unauthenticated users to gain access to sensitive files on the local system, potentially exposing confidential information.
Is there a fix available for CVE-2022-24716?
Yes, the issue has been resolved. It is recommended to update to Icinga Web 2 version 2.9.7 or later to mitigate this vulnerability.
Where can I find more information about CVE-2022-24716?
You can find more information about CVE-2022-24716 at the following references: [Packet Storm](http://packetstormsecurity.com/files/171774/Icinga-Web-2.10-Arbitrary-File-Disclosure.html), [GitHub Commit](https://github.com/Icinga/icingaweb2/commit/9931ed799650f5b8d5e1dc58ea3415a4cdc5773d), [GitHub Security Advisories](https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5p3f-rh28-8frw).