CVE-2024-24819: icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF
First published: Fri Feb 09 2024(Updated: )
icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icinga | <0.22.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-24819?
CVE-2024-24819 has a moderate severity rating due to its potential for cross-site request forgery (CSRF) exploits.
How do I fix CVE-2024-24819?
To fix CVE-2024-24819, you should upgrade to the latest version of the icingaweb2-module-incubator that is above 0.22.0.
What is the impact of CVE-2024-24819 on my system?
CVE-2024-24819 can allow attackers to perform actions on behalf of authenticated users without their consent.
Which versions of icingaweb2-module-incubator are affected by CVE-2024-24819?
Versions of icingaweb2-module-incubator prior to 0.22.0 are affected by CVE-2024-24819.
Does CVE-2024-24819 include any mitigations?
CVE-2024-24819 does not provide built-in mitigations for impacted versions, making upgrades essential.
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- agent/remedy
- agent/severity
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/icinga
- canonical/icinga