Read the docs
TI-2024-16337 Aliases CVE-2024-24820

Icinga Director configuration is susceptible to Cross-Site Request Forgery

Priority HIGH 69CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery (CSRF). It enables attackers to perform changes in the monitoring environment managed by Icinga Director without the awareness of the victim. Users of the map module in version 1.x, should immediately upgrade to v2.0. The mentioned XSS vulnerabilities in Icinga Web are already fixed as well and upgrades to the most recent release of the 2.9, 2.10 or 2.11 branch must be performed if not done yet. Any later major release is also suitable. Icinga Director will receive minor updates to the 1.8, 1.9, 1.10 and 1.11 branches to remedy this issue. Upgrade immediately to a patched release. If that is not feasible, disable the director module for the time being.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed icingaweb2-module-director (Icinga): 1.8.2, 1.9.2, 1.10.3 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Icingaicingaweb2-module-director1.0.0 to before 1.8.2; 1.9.0 to before 1.9.2; 1.10.0 to before 1.10.3; 1.11.0 to before 1.11.11.8.2, 1.9.2, 1.10.3, 1.11.1Patch availableCNA
  • icingaweb2-module-director VendorIcinga Affected 1.0.0 to before 1.8.2; 1.9.0 to before 1.9.2; 1.10.0 to before 1.10.3; 1.11.0 to before 1.11.1 Fixed in 1.8.2, 1.9.2, 1.10.3, 1.11.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*1.0.0 to before 1.8.2; 1.9.0 to before 1.9.2; 1.10.0 to before 1.10.3; 1.11.0 to before 1.11.3VulnerableIcinga
  • cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.8.2; 1.9.0 to before 1.9.2; 1.10.0 to before 1.10.3; 1.11.0 to before 1.11.3 Vulnerable ·Icinga

Remediation

  • Fix · CNA icingaweb2-module-director (Icinga) Fixed in 1.8.2, 1.9.2, 1.10.3, 1.11.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24820

References

Exploit 1

Advisory 2

Other 3

  • TI-2012-05060 Multiple stack-based buffer overflows in the get_history function in history.cgi in… CVSS 2.0HIGH 7.5
  • TI-2013-05840 Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before… CVSS 2.0MEDIUM 5.5
  • TI-2024-32957 Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections CVSS 3.1CRITICAL 9.8
  • TI-2025-30428 Icinga 2 certificate renewal might incorrectly renew an invalid certificate CVSS 4.0CRITICAL 9.3
  • TI-2021-12411 Passwords used to access external services inadvertently exposed through API CVSS 3.1HIGH 8.8
  • TI-2020-17821 Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due… CVSS 3.1CRITICAL 9.1
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences