CVE-2018-18249 Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}${APACHE_RUN...
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}${APACHE_RUN_DIR}${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/icingaweb2(Debian:12) | < 2.6.2-1 | 2.6.2-1 |
| debian/icingaweb2(Debian:13) | < 2.6.2-1 | 2.6.2-1 |
| debian/icingaweb2(Debian:14) | < 2.6.2-1 | 2.6.2-1 |
| icinga web 2 | < 2.6.2 | 2.6.2 |
| ubuntu/icingaweb2(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/icingaweb2(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/icingaweb2(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/icingaweb2(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-18249 vendor-advisory
- openSUSE-SU-2020:0067 vendor-advisory
- herolab.usd.de exploit third-party-advisory