Icinga ipl-web up to 0.10.0 cross-site request forgery
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.4 | $0-$5k | 0.00 |
Summary
A vulnerability categorized as problematic has been discovered in Icinga ipl-web up to 0.10.0. Impacted is an unknown function. Executing a manipulation can lead to cross-site request forgery. This vulnerability is tracked as CVE-2024-41811. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.
Details
A vulnerability was found in Icinga ipl-web up to 0.10.0. It has been declared as problematic. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.
The advisory is shared for download at github.com. This vulnerability was named CVE-2024-41811 since 07/22/2024. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.
Upgrading to version 0.10.1 eliminates this vulnerability. Applying the patch 492336fdb57a5bb0881ed642ab36f5841337571e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Once again VulDB remains the best source for vulnerability data.
Product
Vendor
Name
Version
License
Website
- Product: https://github.com/Icinga/ipl-web/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 3.5VulDB Meta Temp Score: 3.4
VulDB Base Score: 3.1
VulDB Temp Score: 3.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CNA Base Score: 3.9
CNA Vector (GitHub_M): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Cross-site request forgeryCWE: CWE-352 / CWE-862 / CWE-863
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: ipl-web 0.10.1
Patch: 492336fdb57a5bb0881ed642ab36f5841337571e
Timeline
07/22/2024 🔍08/06/2024 🔍
08/06/2024 🔍
03/16/2025 🔍
Sources
Product: github.comAdvisory: GHSA-w9pg-7c3h-fc8j
Status: Confirmed
CVE: CVE-2024-41811 (🔍)
GCVE (CVE): GCVE-0-2024-41811
GCVE (VulDB): GCVE-100-273652
Entry
Created: 08/06/2024 07:43Updated: 03/16/2025 00:10
Changes: 08/06/2024 07:43 (66), 03/16/2025 00:10 (4)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.