Every CVE Search/ Get API key

CVE-2020-24368

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability...

7.5 HighFix available

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

3.28%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
CVE-2020-24368
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
CVE-2020-24368
Updated
2026-11-02
EUVDEUVD-2020-17100 No score

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
EUVD-2020-17100
Updated
2026-11-03
GitHub AdvisoriesGHSA-q432-6q9x-32pf 7.5

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability...

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
GHSA-q432-6q9x-32pf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2020-24368 7.5

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
ALPINE-CVE-2020-24368
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSV 7.5

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
CVE-2020-24368
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-24368 7.5

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.

Record
DEBIAN-CVE-2020-24368
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2020:1674-1 No score

Security update for icingaweb2

This update for icingaweb2 fixes the following issues:

  • icingaweb2 was updated to 2.7.4
    • CVE-2020-24368: Fixed a path Traversal which could have allowed an attacker to access arbitrary files which are readable by the process running (boo#1175530).
Record
openSUSE-SU-2020:1674-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10857-1 No score

icingacli-2.8.4-1.6 on GA media

These are all security issues fixed in the icingacli-2.8.4-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10857-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icingaweb2
Alpine:v3.12
 before 2.7.3-r2
2.7.3-r2
icingaweb2
Debian:12
 before 2.8.2-1
2.8.2-1
icingaweb2
Debian:13
 before 2.8.2-1
2.8.2-1
icingaweb2
Debian:14
 before 2.8.2-1
2.8.2-1
icingaweb2
Debian:9
 before 2.4.1-1+deb9u1, plus listed versions
2.4.1-1
2.4.1-1+deb9u1
icingaweb2
Debian:10
 before 2.6.2-3+deb10u1, plus listed versions
2.6.2-3
2.6.2-3+deb10u1
icingaweb2
SUSE:Package Hub 12
 before 2.7.4-bp152.2.3.1
2.7.4-bp152.2.3.1
icingaweb2
SUSE:Package Hub 15 SP1
 before 2.7.4-bp152.2.3.1
2.7.4-bp152.2.3.1
icingaweb2
SUSE:Package Hub 15 SP2
 before 2.7.4-bp152.2.3.1
2.7.4-bp152.2.3.1
icingaweb2
openSUSE:Leap 15.1
 before 2.7.4-bp152.2.3.1
2.7.4-bp152.2.3.1
icingaweb2
openSUSE:Leap 15.2
 before 2.7.4-bp152.2.3.1
2.7.4-bp152.2.3.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24368 is a high vulnerability (CVSS 7.5) in Icinga Web 2, published August 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in icingaweb2 2.7.3-r2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open