Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13OXBnLTdjM2gtZmM4as4AA-Xn

ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF

Impact

Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF)

Affected products:

• Icinga Web (>=2.12.0)
• Icinga DB Web (>=1.0.0)
• Icinga Notifications Web (>=0.1.0)
• Icinga Web JIRA Integration (>=1.3.0)

All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded.

Patches

Version 0.10.1 will include a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.

Permalink: https://github.com/advisories/GHSA-w9pg-7c3h-fc8j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13OXBnLTdjM2gtZmM4as4AA-Xn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 2 months ago
Updated: about 2 months ago

CVSS Score: 5.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Identifiers: GHSA-w9pg-7c3h-fc8j, CVE-2024-41811
References:

• https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j
• https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e
• https://nvd.nist.gov/vuln/detail/CVE-2024-41811
• https://github.com/advisories/GHSA-w9pg-7c3h-fc8j

Repository: https://github.com/Icinga/ipl-web
Blast Radius: 2.4

Affected Packages