CVE-2022-24716
Path traversal in Icinga Web 2
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Path traversal in Icinga Web 2
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Record
CVE-2022-24716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-29577
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Record
EUVD-2022-29577- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
NVD
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Record
CVE-2022-24716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Path traversal in Icinga Web 2
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Record
CVE-2022-24716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24716
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Record
DEBIAN-CVE-2022-24716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-24716
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
- Record
UBUNTU-CVE-2022-24716- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icingaweb2Debian:12 |
before 2.9.6-1 | 2.9.6-1 |
icingaweb2Debian:13 |
before 2.9.6-1 | 2.9.6-1 |
icingaweb2Debian:14 |
before 2.9.6-1 | 2.9.6-1 |
icingaweb2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.8.2-22.9.3-12.9.4-12.9.5-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | gmh5225/CVE-2022-24716 | 2023-03-20 |
| PoC in GitHub | pumpkinpiteam/CVE-2022-24716 | 2023-03-26 |
| PoC in GitHub | 0x0Jackal/CVE-2022-24716 | 2023-03-27 |
| Exploit-DB | Icinga Web 2.10 - Arbitrary File Disclosure | 2023-04-08 |
| PoC in GitHub | antisecc/CVE-2022-24716 | 2023-05-20 |
| PoC in GitHub | gmh5225/CVE-2022-24716-2 | 2024-04-22 |
| Metasploit | Icingaweb Directory Traversal in Static Library File Requests | 2022-05-09 |
| Nuclei | Icinga Web 2 - Arbitrary File Disclosure |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits | OSV | |
| first indexed | CVE List, EUVD, Exploit-DB, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24716 is a high vulnerability (CVSS 7.5) in Icinga Web 2, published March 8, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 89.4%, the 99th percentile. Fixed in icingaweb2 2.9.6-1.
References
github.com/Icinga/icingaweb2/security/advisories/GHSA-5p3f-rh28-8frw
security.gentoo.org/glsa/202208-05
packetstormsecurity.com/files/171774/Icinga-Web-2.10-Arbitrary-File-Disclosure.html
nvd.nist.gov/vuln/detail/CVE-2022-24716
security-tracker.debian.org/tracker/CVE-2022-24716
ubuntu.com/security/CVE-2022-24716
cve.org/CVERecord?id=CVE-2022-24716