CVE-2018-18249

Icinga Web 2 before 2.6.2 is vulnerable to injection of PHP ini-file directives via environment-variable-based channels used as a conduit to exfiltrate information against endpoints such as /icingaweb2/navigation/add and /icingaweb2/dashboard/new-dashlet. Root cause: lack of input validation for ...

CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18250

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...

CVE-2018-18247

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

CVE-2018-18246: Cross-Site Request Forgery (CSRF)

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

CVE-2018-18247: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18248: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18250: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...

CVE-2018-18249: Improper Control of Generation of Code

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

PT-2018-14381

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows for the injection of PHP ini-file directives through environment variables. This can be achieved by sending specific information to the attacker, such as using a name parameter...

PT-2018-14380

Name of the Vulnerable Software and Affected Versions Icinga Web 2 affected versions not specified Description The issue is related to XSS via several API endpoints, including "/icingaweb2/monitoring/list/services" with the dir parameter, "/icingaweb2/user/list" with the query string,...

PT-2018-14379

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue is related to a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved through the...

PT-2018-14378

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows for CSRF attacks, potentially enabling an attacker to disable the monitoring module or enable the setup module without proper authorization. This can be achieved through specifi...

PT-2018-14382

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows parameters to break navigation dashlets. For example, using a single '$' character as the Name of a Navigation item can cause the problem. Recommendations For versions prior to...

SUSE-SU-2018:3620-1 Security update for icinga

This update for icinga fixes the following issues: Security issues fixed: - CVE-2015-8010: Fixed XSS in the icinga classic UI boo952777 - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root boo1011630 and boo1018047...

openSUSE Security Update : icinga (openSUSE-2018-1206)

This update for icinga fixes the following issues : Update to 1.14.0 - CVE-2015-8010: Fixed XSS in the icinga classic UI boo952777 - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root boo1011630 and boo1018047 - CVE-2016-0726: removed the pre-configured...

openSUSE: Security Advisory for icinga (openSUSE-SU-2018:3258-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for icinga (moderate)

This update for icinga fixes the following issues: Update to 1.14.0 - CVE-2015-8010: Fixed XSS in the icinga classic UI boo952777 - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root boo1011630 and boo1018047 - CVE-2016-0726: removed the pre-configured...