FKIE_CVE-2024-49369
Vulnerability from fkie_nvd - Published: 2024-11-12 17:15 - Updated: 2025-11-26 13:01
Severity ?
Summary
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B6D84E8E-4E8B-4431-8B88-357A80C12C83",
"versionEndExcluding": "2.11.12",
"versionStartIncluding": "2.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F0C8CAD-BA9A-4913-879B-F3591466E433",
"versionEndExcluding": "2.12.11",
"versionStartIncluding": "2.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65FC1284-5140-4E2B-B439-644841730745",
"versionEndExcluding": "2.13.10",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C04E07AA-4F66-4FEB-A769-CAF15A6DB21F",
"versionEndExcluding": "2.14.3",
"versionStartIncluding": "2.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12."
},
{
"lang": "es",
"value": "Icinga es un sistema de monitoreo que verifica la disponibilidad de los recursos de red, notifica a los usuarios sobre interrupciones y genera datos de rendimiento para informes. La validaci\u00f3n del certificado TLS en todas las versiones de Icinga 2 a partir de la 2.4.0 ten\u00eda fallas, lo que permit\u00eda a un atacante hacerse pasar tanto por nodos de cl\u00faster confiables como por cualquier usuario de API que use certificados de cliente TLS para autenticaci\u00f3n (objetos ApiUser con el atributo client_cn establecido). Esta vulnerabilidad se ha corregido en v2.14.3, v2.13.10, v2.12.11 y v2.11.12."
}
],
"id": "CVE-2024-49369",
"lastModified": "2025-11-26T13:01:15.760",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-11-12T17:15:08.250",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-295"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…