CVE-2024-24819: icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF
icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class gipfl\Web\Form is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
icingaweb2-module-incubator base implementation for HTML formsto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24819?
CVE-2024-24819 has a moderate severity rating due to its potential for cross-site request forgery (CSRF) exploits.
How do I fix CVE-2024-24819?
To fix CVE-2024-24819, you should upgrade to the latest version of the icingaweb2-module-incubator that is above 0.22.0.
What is the impact of CVE-2024-24819 on my system?
CVE-2024-24819 can allow attackers to perform actions on behalf of authenticated users without their consent.
Which versions of icingaweb2-module-incubator are affected by CVE-2024-24819?
Versions of icingaweb2-module-incubator prior to 0.22.0 are affected by CVE-2024-24819.
Does CVE-2024-24819 include any mitigations?
CVE-2024-24819 does not provide built-in mitigations for impacted versions, making upgrades essential.