CVE-2018-6533: An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run…

PriorityP338high7.8CVSS 3.0

AVLACLPRLUINSUCHIHAH

EPSS

0.41%

32.4th percentile

An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code (a larger issue than CVE-2017-16933).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	icinga2	< icinga2 2.8.4-1 (bookworm)	icinga2 2.8.4-1 (bookworm)
icinga	icinga	2.0.0 – 2.8.1	—
icinga	icinga2	>= 0 < 2.8.4-1	2.8.4-1
icinga	icinga2	>= 0 < 2.8.4-1	2.8.4-1
icinga	icinga2	>= 0 < 2.8.4-1	2.8.4-1
icinga	icinga2	>= 0 < 2.8.4-1	2.8.4-1

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

osv7.0HIGH

vendor_debian7.0LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.