CVE-2018-18249

Опубликовано: 17 дек. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}${APACHE_RUN_DIR}${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt
Exploit
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*

Версия до 2.6.2 (исключая)

EPSS

Процентиль: 66%

0.00513

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

Связанные уязвимости

CVE-2018-18249

CVSS3: 9.8

ubuntu

около 7 лет назад

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.

CVE-2018-18249

CVSS3: 9.8

debian

около 7 лет назад

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives ...

GHSA-h88r-wm6r-9ghp

CVSS3: 9.8

github

больше 3 лет назад

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.

openSUSE-SU-2020:0067-1

suse-cvrf

около 6 лет назад

Security update for icingaweb2

EPSS

Процентиль: 66%

0.00513

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94