CVE-2024-49369 (GCVE-0-2024-49369)

Vulnerability from cvelistv5 – Published: 2024-11-12 16:44 – Updated: 2025-11-03 22:22
VLAI?
Summary
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version
Icinga icinga2 Affected: >= 2.4.0, < 2.11.12
Affected: >= 2.12.0, < 2.12.11
Affected: >= 2.13.0, < 2.13.10
Affected: >= 2.14.0, < 2.14.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "icinga_web_2",
            "vendor": "icinga",
            "versions": [
              {
                "lessThan": "2.11.12",
                "status": "affected",
                "version": "2.4.0",
                "versionType": "custom"
              },
              {
                "lessThan": "2.12.11",
                "status": "affected",
                "version": "2.12.0",
                "versionType": "custom"
              },
              {
                "lessThan": "2.13.10",
                "status": "affected",
                "version": "2.13.0",
                "versionType": "custom"
              },
              {
                "lessThan": "2.14.3",
                "status": "affected",
                "version": "2.14.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T17:01:31.893265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T17:06:41.572Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:15.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "icinga2",
          "vendor": "Icinga",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.4.0, \u003c 2.11.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.14.0, \u003c 2.14.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-12T16:44:01.713Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv"
        },
        {
          "name": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c"
        },
        {
          "name": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8"
        },
        {
          "name": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe"
        },
        {
          "name": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6"
        },
        {
          "name": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831"
        },
        {
          "name": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3"
        }
      ],
      "source": {
        "advisory": "GHSA-j7wq-r9mg-9wpv",
        "discovery": "UNKNOWN"
      },
      "title": "Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-49369",
    "datePublished": "2024-11-12T16:44:01.713Z",
    "dateReserved": "2024-10-14T13:56:34.811Z",
    "dateUpdated": "2025-11-03T22:22:15.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.\"}, {\"lang\": \"es\", \"value\": \"Icinga es un sistema de monitoreo que verifica la disponibilidad de los recursos de red, notifica a los usuarios sobre interrupciones y genera datos de rendimiento para informes. La validaci\\u00f3n del certificado TLS en todas las versiones de Icinga 2 a partir de la 2.4.0 ten\\u00eda fallas, lo que permit\\u00eda a un atacante hacerse pasar tanto por nodos de cl\\u00faster confiables como por cualquier usuario de API que use certificados de cliente TLS para autenticaci\\u00f3n (objetos ApiUser con el atributo client_cn establecido). Esta vulnerabilidad se ha corregido en v2.14.3, v2.13.10, v2.12.11 y v2.11.12.\"}]",
      "id": "CVE-2024-49369",
      "lastModified": "2024-11-13T17:01:58.603",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-11-12T17:15:08.250",
      "references": "[{\"url\": \"https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3\", \"source\": \"security-advisories@github.com\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-295\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49369\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-11-12T17:15:08.250\",\"lastModified\":\"2025-11-26T13:01:15.760\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.\"},{\"lang\":\"es\",\"value\":\"Icinga es un sistema de monitoreo que verifica la disponibilidad de los recursos de red, notifica a los usuarios sobre interrupciones y genera datos de rendimiento para informes. La validaci\u00f3n del certificado TLS en todas las versiones de Icinga 2 a partir de la 2.4.0 ten\u00eda fallas, lo que permit\u00eda a un atacante hacerse pasar tanto por nodos de cl\u00faster confiables como por cualquier usuario de API que use certificados de cliente TLS para autenticaci\u00f3n (objetos ApiUser con el atributo client_cn establecido). Esta vulnerabilidad se ha corregido en v2.14.3, v2.13.10, v2.12.11 y v2.11.12.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.4.0\",\"versionEndExcluding\":\"2.11.12\",\"matchCriteriaId\":\"B6D84E8E-4E8B-4431-8B88-357A80C12C83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.12.0\",\"versionEndExcluding\":\"2.12.11\",\"matchCriteriaId\":\"7F0C8CAD-BA9A-4913-879B-F3591466E433\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.13.0\",\"versionEndExcluding\":\"2.13.10\",\"matchCriteriaId\":\"65FC1284-5140-4E2B-B439-644841730745\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.14.0\",\"versionEndExcluding\":\"2.14.3\",\"matchCriteriaId\":\"C04E07AA-4F66-4FEB-A769-CAF15A6DB21F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:15.314Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49369\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-12T17:01:31.893265Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*\"], \"vendor\": \"icinga\", \"product\": \"icinga_web_2\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.4.0\", \"lessThan\": \"2.11.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.12.0\", \"lessThan\": \"2.12.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.13.0\", \"lessThan\": \"2.13.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.14.0\", \"lessThan\": \"2.14.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-12T17:05:47.848Z\"}}], \"cna\": {\"title\": \"Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections\", \"source\": {\"advisory\": \"GHSA-j7wq-r9mg-9wpv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Icinga\", \"product\": \"icinga2\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.4.0, \u003c 2.11.12\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.12.0, \u003c 2.12.11\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.13.0, \u003c 2.13.10\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.14.0, \u003c 2.14.3\"}]}], \"references\": [{\"url\": \"https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv\", \"name\": \"https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c\", \"name\": \"https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8\", \"name\": \"https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe\", \"name\": \"https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6\", \"name\": \"https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831\", \"name\": \"https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3\", \"name\": \"https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295: Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-11-12T16:44:01.713Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49369\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:22:15.314Z\", \"dateReserved\": \"2024-10-14T13:56:34.811Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-11-12T16:44:01.713Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.