Icinga

Records56All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high26CVSS 7.0–8.9

Exploited now

Icinga records in CISA KEV

No Icinga vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Icinga 31 records HIGH Icinga Web 2 13 records HIGH Icinga Db Web 2 records LOW Icinga Powershell Framework 1 record LOW Icinga Web Jira Integration 1 record LOW Icingaweb2-module-incubator 1 record LOW

Records

56 records

TI-2022-08531 CVE-2022-24716

Path traversal in Icinga Web 2

HIGH 81

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.89378 Published 2022-03-08 Fixed in 2.9.6 CWE-22

TI-2024-16337 CVE-2024-24820

Icinga Director configuration is susceptible to Cross-Site Request Forgery

HIGH 69

Icinga Director is a tool designed to make Icinga 2 configuration handling easy.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00401 Published 2024-02-09 Fixed in 1.8.2, 1.9.2 +2 CWE-352

TI-2012-05060 CVE-2012-6096 · GHSA-976m-29vc-cxx7

Multiple stack-based buffer overflows in the get_history function in history.cgi in…

HIGH 69

Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to exe…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.6645 Published 2013-01-22 No fix listed CWE-119

TI-2013-05840 CVE-2013-7108 · GHSA-48qr-xf75-jc6h

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before…

MEDIUM 60

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.61625 Published 2014-01-14 Fix deferred CWE-20

TI-2022-08530 CVE-2022-24715

Arbitrary code execution for authenticated users in Icinga Web 2

MEDIUM 56

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.14943 Published 2022-03-08 Fixed in 2.8.6, 2.9.6 CWE-22

TI-2024-32957 CVE-2024-49369

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

MEDIUM 54

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02939 Published 2024-11-12 Fixed in 2.11.12, 2.12.11 +2 CWE-295

TI-2026-44105 CVE-2026-61550

Icinga 2: Improper access control for JSON-RPC update certificate messages

MEDIUM 50

Icinga 2 is an open source monitoring system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00674 Published 2026-09-18 Fixed in 2.14.9, 2.15.4 +1 CWE-862

TI-2025-30428 CVE-2025-48057

Icinga 2 certificate renewal might incorrectly renew an invalid certificate

MEDIUM 48

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00462 Published 2025-05-27 Fixed in 2.14.6, 2.13.12 +1 CWE-296

TI-2026-44106 CVE-2026-61551

Icinga 2: Stack overflow via deeply nested JSON objects

MEDIUM 45

Icinga 2 is an open source monitoring system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00941 Published 2026-09-18 Fixed in 2.14.9, 2.15.4 +1 CWE-674

TI-2018-12897 CVE-2018-18249 · GHSA-h88r-wm6r-9ghp

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors…

MEDIUM 45

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01489 Published 2018-12-17 No fix listed CWE-94

TI-2021-12411 CVE-2021-32743

Passwords used to access external services inadvertently exposed through API

MEDIUM 42

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01803 Published 2021-07-15 Fixed in 2.11.10 CWE-202

TI-2020-17821 CVE-2020-29663

Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due…

MEDIUM 42

Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01573 Published 2020-12-15 No fix listed CWE-295

TI-2011-01902 CVE-2011-2179 · GHSA-p3hf-j3h8-8mqv

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1)…

MEDIUM 42

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as dem…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.26037 Published 2011-06-14 No fix listed CWE-79

TI-2021-12407 CVE-2021-32739

Improper privilege management in icinga2

MEDIUM 40

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0114 Published 2021-07-15 No fix listed CWE-267

TI-2020-14912 CVE-2020-24368 · GHSA-q432-6q9x-32pf

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal…

LOW 39

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0328 Published 2020-08-19 No fix listed CWE-22

TI-2024-16336 CVE-2024-24819

icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF

LOW 38

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0026 Published 2024-02-09 Fixed in 0.22.0 CWE-352

TI-2023-14423 CVE-2023-30607

icingaweb2-module-jira template and field configuration are susceptible to CSRF

LOW 38

icingaweb2-module-jira provides integration with Atlassian Jira.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00263 Published 2023-07-05 Fixed in 1.3.2 CWE-352

TI-2018-04814 CVE-2018-6535 · GHSA-5535-phc2-4862

An issue was discovered in Icinga 2.x through 2.8.1.

LOW 38

An issue was discovered in Icinga 2.x through 2.8.1.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01329 Published 2018-02-27 No fix listed

TI-2025-20239 CVE-2025-27404

Icinga Web 2 DOM-based XSS vulnerability

LOW 37

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00607 Published 2025-03-26 Fixed in 2.11.5, 2.12.3 CWE-79

TI-2012-02969 CVE-2012-3441 · GHSA-rpmx-xcm7-5crg

The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga…

LOW 37

The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02409 Published 2012-08-25 No fix listed CWE-264

TI-2025-20241 CVE-2025-27406

Icinga Reporting Stored XSS leads to SSRF

LOW 36

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00328 Published 2025-03-26 Fixed in 1.0.3 CWE-79

TI-2025-20240 CVE-2025-27405

Icinga Web 2 has XSS in embedded content

LOW 36

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-26 Fixed in 2.11.5, 2.12.3 CWE-79

TI-2021-15573 CVE-2021-37698

Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer

LOW 36

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.