CVE-2024-49369criticalCWE-295

CVE-2024-49369: fallo crítico en icinga2

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear icinga2+ Monitorear icinga2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

48Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 9.8epss 2.9%
de la publicación al arma17 días
Publicada en NVD12 nov
1ª PoC+17d
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Icinga · icinga2
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — icinga2

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-32743HIGHPasswords used to access external services inadvertently exposed through APIEPSS 1.8%CVE-2021-37698HIGHMissing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2WriterEPSS 1.4%CVE-2021-32739HIGHResults of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesEPSS 1.1%CVE-2026-61551HIGHIcinga 2: Stack overflow via deeply nested JSON objectsEPSS 0.9%CVE-2026-61552HIGHIcinga 2 DSL Injection via Unescaped Import Template NameEPSS 0.9%CVE-2026-61550CRITICALIcinga 2: Improper access control for JSON-RPC update certificate messagesEPSS 0.7%