CVE-2022-24714

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2.

• CWE-863

• https://github.com/Icinga/icingaweb2/commit/6e989d05a1568a6733a3d912001251acc51d9293Patch, Third Party Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-qcmg-vr56-x9wfThird Party Advisory
• https://security.gentoo.org/glsa/202208-05Third Party Advisory
• https://github.com/Icinga/icingaweb2/commit/6e989d05a1568a6733a3d912001251acc51d9293Patch, Third Party Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-qcmg-vr56-x9wfThird Party Advisory
• https://security.gentoo.org/glsa/202208-05Third Party Advisory

Published

Mar 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24709@awsui/components-react is the main AWS UI package which con…6.1
• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24710Weblate is a copyleft software web-based continuous localiza…5.4
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8
• CVE-2022-24712CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…8.8
• CVE-2022-24713regex is an implementation of regular expressions for the Ru…7.5
• CVE-2022-24715Icinga Web 2 is an open source monitoring web interface, fra…8.8
• CVE-2022-24716Icinga Web 2 is an open source monitoring web interface, fra…7.5
• CVE-2022-24717ssr-pages is an HTML page builder for the purpose of server-…6.1
• CVE-2022-24718ssr-pages is an HTML page builder for the purpose of server-…6.5
• CVE-2022-24719Fluture-Node is a FP-style HTTP and streaming utils for Node…6.1
• CVE-2022-2472Improper Initialization vulnerability in the local server co…5.5