CVE-2022-24715

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

• CWE-22

• http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html
• https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafbPatch, Third Party Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63Third Party Advisory
• https://security.gentoo.org/glsa/202208-05Third Party Advisory
• http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html
• https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafbPatch, Third Party Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63Third Party Advisory
• https://security.gentoo.org/glsa/202208-05Third Party Advisory

Published

Mar 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24710Weblate is a copyleft software web-based continuous localiza…5.4
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8
• CVE-2022-24712CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…8.8
• CVE-2022-24713regex is an implementation of regular expressions for the Ru…7.5
• CVE-2022-24714Icinga Web 2 is an open source monitoring web interface, fra…5.3
• CVE-2022-24716Icinga Web 2 is an open source monitoring web interface, fra…7.5
• CVE-2022-24717ssr-pages is an HTML page builder for the purpose of server-…6.1
• CVE-2022-24718ssr-pages is an HTML page builder for the purpose of server-…6.5
• CVE-2022-24719Fluture-Node is a FP-style HTTP and streaming utils for Node…6.1
• CVE-2022-2472Improper Initialization vulnerability in the local server co…5.5
• CVE-2022-24720image_processing is an image processing wrapper for libvips …9.8