CVE-2021-32746: falha de média gravidade em icingaweb2
Possible path traversal by use of the `doc` module
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.3%
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator and users need explicit access permission to use it. Then, by visiting a certain route, it is possible to gain access to arbitrary files readable by the web-server user. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, an administrator may disable the `doc` module or revoke permission to use it from all users.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Icinga · icingaweb2CVEs relacionadas — icingaweb2
No mesmo produto, das mais perigosas para as menos.
CVE-2022-24716HIGHPath traversal in Icinga Web 2EPSS 89.4%CVE-2022-24715HIGHArbitrary code execution for authenticated users in Icinga Web 2EPSS 14.9%CVE-2021-32747MEDIUMCustom variable protection and blacklists can be circumventedEPSS 1.4%CVE-2022-24714MEDIUMDisclosure of hosts and related data, linked to decommissioned services in Icinga Web 2EPSS 1.2%CVE-2025-27404HIGHIcinga Web 2 DOM-based XSS vulnerabilityEPSS 0.6%CVE-2025-27405HIGHIcinga Web 2 has XSS in embedded contentEPSS 0.3%