ALT-PU-2025-10630

Высокий

ALT-PU-2025-10630: package icingaweb2-module-incubator update to version 0.22.0-alt1

Источник

errata.altlinux.org

Дата публикации

21.08.2025

Дата обновления

21.08.2025

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades icingaweb2-module-incubator to version 0.22.0-alt1.

Устраненные уязвимости1

CVE-2024-24819

Высокий 8.8

Дата публикации: 09.02.2024

CWE-352

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class gipfl\Web\Form is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1

Высокий 8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Ссылки

CVE-2024-24819 https://nvd.nist.gov/vuln/detail/CVE-2024-24819

Ссылки1

ALT-PU-2025-10630 https://errata.altlinux.org/ALT-PU-2025-10630

Связанные уязвимости

CVE-2024-24819

CVSS3: 8.8

nvd

почти 3 года назад

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.

BDU:2025-11550

CVSS3: 8.8

fstec

больше 2 лет назад

Уязвимость модуля Incubator PHP фреймворка Icinga Web 2, позволяющая нарушителю осуществить CSRF-атаку