TI-2022-08531 CVE-2022-24716
Path traversal in Icinga Web 2
Priority HIGH 81
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.
Icinga
Records56All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high26CVSS 7.0–8.9
Exploited now
Icinga records in CISA KEVNo Icinga vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
13 records in Icinga Web 2 · all components
Priority MEDIUM 56
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.
TI-2018-12897 CVE-2018-18249 · GHSA-h88r-wm6r-9ghp
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors…
Priority MEDIUM 45
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_…
TI-2020-14912 CVE-2020-24368 · GHSA-q432-6q9x-32pf
Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal…
Priority LOW 39
Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2.
TI-2025-20239 CVE-2025-27404
Icinga Web 2 DOM-based XSS vulnerability
Priority LOW 37
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.
TI-2025-20240 CVE-2025-27405
Icinga Web 2 has XSS in embedded content
Priority LOW 36
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.
TI-2018-12898 CVE-2018-18250 · GHSA-64hj-h2vf-7vhp
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as…
Priority LOW 35
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item.
TI-2022-08529 CVE-2022-24714
Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2
Priority LOW 33
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.
TI-2018-12894 CVE-2018-18246 · GHSA-4hph-9j96-cwr9
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring…
Priority LOW 29
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.
TI-2018-12896 CVE-2018-18248 · GHSA-xx3p-ffq8-9pcp
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the…
Priority LOW 28
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string.
TI-2025-21503 CVE-2025-30164
Icinga Web 2 has open redirect on login page
Priority LOW 27
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.
TI-2018-12895 CVE-2018-18247 · GHSA-rgg3-7933-rh7j
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.
Priority LOW 25
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.
TI-2025-20418 CVE-2025-27609
Icinga Web 2 Vulnerable to Reflected XSS
Priority LOW 9
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.