CVE-2021-32747 — Sensitive Information Exposure in Icinga

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
6.5MEDIUMNVD
CNA5.3
EPSS
0.5%
top 32.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Icinga Icingaweb2Icinga
Timeline
PublishedJul 12

Description

Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and values on configuration objects in Icinga 2. These are commonly used to reference secrets in other configurations such as check commands to be able to authenticate with a service being checked. Icinga Web 2 displays these custom variables to lo…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDicinga/icinga2.0.0 — 2.7.5+1
▶Debianicinga/icingaweb2< 2.8.4-1+2
▶CVEListV5icinga/icingaweb2>= 2.0.0, <= 2.8.2

🔴Vulnerability Details

2
CVEList
Custom variable protection and blacklists can be circumvented↗2021-07-12
▶
OSV
CVE-2021-32747: Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface↗2021-07-12
▶

📋Vendor Advisories

1
Debian
CVE-2021-32747: icingaweb2 - Icinga Web 2 is an open source monitoring web interface, framework, and command-...↗2021
▶
CVE-2021-32747 — Sensitive Information Exposure | cvebase