CVE-2024-24820

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery (CSRF). It enables attackers to perform changes in the monitoring environment managed by Icinga Director without the awareness of the victim. Users of the map module in version 1.x, should immediately upgrade to v2.0. The mentioned XSS vulnerabilities in Icinga Web are already fixed as well and upgrades to the most recent release of the 2.9, 2.10 or 2.11 branch must be performed if not done yet. Any later major release is also suitable. Icinga Director will receive minor updates to the 1.8, 1.9, 1.10 and 1.11 branches to remedy this issue. Upgrade immediately to a patched release. If that is not feasible, disable the director module for the time being.

• CWE-352
• CWE-352

• https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/Press/Media Coverage
• https://github.com/Icinga/icingaweb2-module-director/security/advisories/GHSA-3mwp-5p5v-j6q3Third Party Advisory
• https://github.com/Icinga/icingaweb2/issues?q=is%3Aissue++is%3Aclosed+4979+4960+4947Issue Tracking
• https://github.com/nbuchwitz/icingaweb2-module-map/pull/86Exploit
• https://support.apple.com/en-is/guide/safari/sfri11471/16.0Third Party Advisory
• https://www.chromium.org/updates/same-site/Issue Tracking
• https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/Press/Media Coverage
• https://github.com/Icinga/icingaweb2-module-director/security/advisories/GHSA-3mwp-5p5v-j6q3Third Party Advisory
• https://github.com/Icinga/icingaweb2/issues?q=is%3Aissue++is%3Aclosed+4979+4960+4947Issue Tracking
• https://github.com/nbuchwitz/icingaweb2-module-map/pull/86Exploit
• https://support.apple.com/en-is/guide/safari/sfri11471/16.0Third Party Advisory
• https://www.chromium.org/updates/same-site/Issue Tracking

Published

Feb 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24815CKEditor4 is an open source what-you-see-is-what-you-get HTM…6.1
• CVE-2024-24816CKEditor4 is an open source what-you-see-is-what-you-get HTM…6.1
• CVE-2024-24817Discourse Calendar adds the ability to create a dynamic cale…5.3
• CVE-2024-24818EspoCRM is an Open Source Customer Relationship Management s…5.9
• CVE-2024-24819icingaweb2-module-incubator is a working project of bleeding…8.8
• CVE-2024-2482A vulnerability has been found in Surya2Developer Hostel Man…3.7
• CVE-2024-24821Composer is a dependency Manager for the PHP language. In af…7.8
• CVE-2024-24822Pimcore's Admin Classic Bundle provides a backend user inter…9.1
• CVE-2024-24823Graylog is a free and open log management platform. Starting…4.4
• CVE-2024-24824Graylog is a free and open log management platform. Starting…8.8
• CVE-2024-24825DIRAC is a distributed resource framework. In affected versi…7.5
• CVE-2024-24826Exiv2 is a command-line utility and C++ library for reading,…5