CVE-2024-41811
ipl/web susceptible to Cross-Site Request Forgery (CSRF)
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
ipl/web susceptible to Cross-Site Request Forgery (CSRF)
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
CVE-2024-41811- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2024-2675
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
EUVD-2024-2675- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w9pg-7c3h-fc8j
ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF
Impact
Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF)
Affected products:
- Icinga Web (>=2.12.0)
- Icinga DB Web (>=1.0.0)
- Icinga Notifications Web (>=0.1.0)
- Icinga Web JIRA Integration (>=1.3.0)
All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded.
Patches
Version 0.10.1 will include a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
GHSA-w9pg-7c3h-fc8j- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
CVE-2024-41811- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
ipl/web susceptible to Cross-Site Request Forgery (CSRF)
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
CVE-2024-41811- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-41811
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
DEBIAN-CVE-2024-41811- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-w9pg-7c3h-fc8j
ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF
Impact
Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF)
Affected products:
- Icinga Web (>=2.12.0)
- Icinga DB Web (>=1.0.0)
- Icinga Notifications Web (>=0.1.0)
- Icinga Web JIRA Integration (>=1.3.0)
All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded.
Patches
Version 0.10.1 will include a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
GHSA-w9pg-7c3h-fc8j- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-41811
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
- Record
UBUNTU-CVE-2024-41811- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ipl/webPackagist |
before 0.10.1 | 0.10.1 |
icinga-php-libraryDebian:12 |
All versions, plus listed versions 0.10.1-10.11.0-1~exp10.11.0-1~exp20.11.1-1~exp10.12.0-1 Show 22 moreShow less0.12.0-1~exp10.13.0-10.13.0-1~exp10.13.1-10.13.2-10.14.0-10.14.1-10.14.2-10.16.0-1~exp10.16.1-1~exp10.17.0-10.17.0-1~exp10.17.1-10.18.0-10.18.1-10.19.0-10.19.1-10.19.2-11.0.0-11.0.1-11.1.0-11.2.0-1 |
None known |
icinga-php-libraryDebian:13 |
before 0.14.1-1 | 0.14.1-1 |
icinga-php-libraryDebian:14 |
before 0.14.1-1 | 0.14.1-1 |
ipl/webPackagist |
before 0.10.1, plus listed versions v0.1.0v0.10.0v0.2.0v0.2.1v0.3.0 Show 9 moreShow lessv0.4.0v0.5.0v0.6.0v0.7.0v0.7.1v0.8.0v0.9.0v0.9.1v0.9.2 |
0.10.1 |
icinga-php-libraryUbuntu:22.04:LTS |
All versions, plus listed versions 0.6.1-10.7.0-1 |
None known |
icinga-php-libraryUbuntu:24.04:LTS |
All versions, plus listed versions 0.10.1-10.13.0-10.13.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-41811 is a low vulnerability (CVSS 3.9) in Icinga Ipl-web, published August 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in ipl/web 0.10.1.
References
github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j
nvd.nist.gov/vuln/detail/CVE-2024-41811
security-tracker.debian.org/tracker/CVE-2024-41811