CVE-2022-24715: icinga icinga_web_2 Path Traversal

Vulnerability summary

CVE-2022-24715 is a high (CVSS 8.8) Path Traversal vulnerability in icinga icinga_web_2. EPSS estimates a 14.67% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-03-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.