VulnerabilityAnalyzed

CVE-2024-49369

The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the…

CRITICAL 9.8EPSS 2.92%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.92% probability · 86th percentile
CISA KEV: Not listed
Weakness: CWE-295
Affected: icinga/icinga · debian/debian linux
Source: security-advisories@github.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.