CVE-2024-24820
CVSS 3.1 Score 8.3 of 10 (high)
Details
Summary
CVE-2024-24820 is a newly disclosed vulnerability affecting Icinga Director, a configuration handling tool for Icinga 2. The vulnerability involves unprotected forms against Cross-Site Request Forgery (CSRF), allowing attackers to manipulate the monitoring environment managed by Icinga Director without the user's knowledge. The map module in version 1.x is particularly affected, and users are urged to upgrade to version 2.0. Additionally, upgrades to the most recent releases of the 2.9, 2.10, or 2.11 branch are necessary if not already done. Icinga Director will receive updates for versions 1.8, 1.9, 1.10, and 1.11 to address this issue. Users should upgrade to a patched release immediately, or disable the director module as a temporary measure if an upgrade is not feasible. Previously reported XSS vulnerabilities in Icinga Web have already been addressed through updates.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Icinga
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions