CVE-2024-41811: ipl/web susceptible to Cross-Site Request Forgery (CSRF)

Severity: low (CVSS 3.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-05 · updated 2026-06-17
Weakness: CWE-352

Description

ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.

Affected products

Icinga ipl-web: before 0.10.1

References

https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e
https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j

Get alerted when CVE-2024-41811 or the next vulnerability affects your stack