What’s Vulnerable › Vulnerabilities

CVE-2022-24715: Arbitrary code execution for authenticated users in Icinga Web 2

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-08 · updated 2026-06-17
• Weakness: CWE-22

Description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

Affected products

• icingaweb2: before 2.8.6; from 2.9.0 before 2.9.6 — fixed in 2.8.6, 2.9.6

How to fix

Upgrade to a fixed version: icingaweb2 2.8.6, 2.9.6. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html
• https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63
• https://security.gentoo.org/glsa/202208-05
• http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html
• https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63
• https://security.gentoo.org/glsa/202208-05

Get alerted when CVE-2022-24715 or the next vulnerability affects your stack