CVE-2022-24716

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.9.6 and 2.10

Description The issue allows unauthenticated users to leak the contents of files on the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This is due to insufficient path name restrictions in the PHP framework. An attacker can exploit this to execute arbitrary code remotely.

Recommendations For versions prior to 2.9.6, update to version 2.9.6 or later. For versions prior to 2.10, update to version 2.10 or later. As a general measure, rotate database credentials to minimize potential damage from leaked credentials.