CVE-2018-18249: icinga icinga_web_2 Code Injection

Vulnerability summary

CVE-2018-18249 is a critical (CVSS 9.8) Code Injection vulnerability in icinga icinga_web_2. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-12-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.