Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2022-24716

Description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.

POC

Reference

- http://packetstormsecurity.com/files/171774/Icinga-Web-2.10-Arbitrary-File-Disclosure.html

Github

- https://github.com/ARPSyndicate/cvemon

- https://github.com/JacobEbben/CVE-2022-24716

- https://github.com/antisecc/CVE-2022-24716

- https://github.com/doosec101/CVE-2022-24716

- https://github.com/joaoviictorti/CVE-2022-24716

- https://github.com/karimhabush/cyberowl

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/pumpkinpiteam/CVE-2022-24716