CVE-2024-49369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-49369", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-10-14T13:56:34.811Z", "datePublished": "2024-11-12T16:44:01.713Z", "dateUpdated": "2025-11-03T22:22:15.314Z"}, "containers": {"cna": {"title": "Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv"}, {"name": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c", "tags": ["x_refsource_MISC"], "url": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c"}, {"name": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8", "tags": ["x_refsource_MISC"], "url": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8"}, {"name": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe", "tags": ["x_refsource_MISC"], "url": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe"}, {"name": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6", "tags": ["x_refsource_MISC"], "url": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6"}, {"name": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831", "tags": ["x_refsource_MISC"], "url": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831"}, {"name": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3", "tags": ["x_refsource_MISC"], "url": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3"}], "affected": [{"vendor": "Icinga", "product": "icinga2", "versions": [{"version": ">= 2.4.0, < 2.11.12", "status": "affected"}, {"version": ">= 2.12.0, < 2.12.11", "status": "affected"}, {"version": ">= 2.13.0, < 2.13.10", "status": "affected"}, {"version": ">= 2.14.0, < 2.14.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-12T16:44:01.713Z"}, "descriptions": [{"lang": "en", "value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12."}], "source": {"advisory": "GHSA-j7wq-r9mg-9wpv", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "icinga", "product": "icinga_web_2", "cpes": ["cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.4.0", "status": "affected", "lessThan": "2.11.12", "versionType": "custom"}, {"version": "2.12.0", "status": "affected", "lessThan": "2.12.11", "versionType": "custom"}, {"version": "2.13.0", "status": "affected", "lessThan": "2.13.10", "versionType": "custom"}, {"version": "2.14.0", "status": "affected", "lessThan": "2.14.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-12T17:01:31.893265Z", "id": "CVE-2024-49369", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T17:06:41.572Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:22:15.314Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:22:15.314Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-49369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-12T17:01:31.893265Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*"], "vendor": "icinga", "product": "icinga_web_2", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "2.11.12", "versionType": "custom"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.11", "versionType": "custom"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.10", "versionType": "custom"}, {"status": "affected", "version": "2.14.0", "lessThan": "2.14.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T17:05:47.848Z"}}], "cna": {"title": "Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections", "source": {"advisory": "GHSA-j7wq-r9mg-9wpv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Icinga", "product": "icinga2", "versions": [{"status": "affected", "version": ">= 2.4.0, < 2.11.12"}, {"status": "affected", "version": ">= 2.12.0, < 2.12.11"}, {"status": "affected", "version": ">= 2.13.0, < 2.13.10"}, {"status": "affected", "version": ">= 2.14.0, < 2.14.3"}]}], "references": [{"url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv", "name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c", "name": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8", "name": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe", "name": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6", "name": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831", "name": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831", "tags": ["x_refsource_MISC"]}, {"url": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3", "name": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-12T16:44:01.713Z"}}}, "cveMetadata": {"cveId": "CVE-2024-49369", "state": "PUBLISHED", "dateUpdated": "2025-11-03T22:22:15.314Z", "dateReserved": "2024-10-14T13:56:34.811Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-11-12T16:44:01.713Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "icinga2", "vendor": "Icinga", "versions": [{"status": "affected", "version": ">= 2.4.0, < 2.11.12"}, {"status": "affected", "version": ">= 2.12.0, < 2.12.11"}, {"status": "affected", "version": ">= 2.13.0, < 2.13.10"}, {"status": "affected", "version": ">= 2.14.0, < 2.14.3"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "icinga_web_2", "vendor": "icinga", "versions": [{"lessThan": "2.11.12", "status": "affected", "version": "2.4.0", "versionType": "custom"}, {"lessThan": "2.12.11", "status": "affected", "version": "2.12.0", "versionType": "custom"}, {"lessThan": "2.13.10", "status": "affected", "version": "2.13.0", "versionType": "custom"}, {"lessThan": "2.14.3", "status": "affected", "version": "2.14.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6D84E8E-4E8B-4431-8B88-357A80C12C83", "versionEndExcluding": "2.11.12", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0C8CAD-BA9A-4913-879B-F3591466E433", "versionEndExcluding": "2.12.11", "versionStartIncluding": "2.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "65FC1284-5140-4E2B-B439-644841730745", "versionEndExcluding": "2.13.10", "versionStartIncluding": "2.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "C04E07AA-4F66-4FEB-A769-CAF15A6DB21F", "versionEndExcluding": "2.14.3", "versionStartIncluding": "2.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12."}, {"lang": "es", "value": "Icinga es un sistema de monitoreo que verifica la disponibilidad de los recursos de red, notifica a los usuarios sobre interrupciones y genera datos de rendimiento para informes. La validaci\u00f3n del certificado TLS en todas las versiones de Icinga 2 a partir de la 2.4.0 ten\u00eda fallas, lo que permit\u00eda a un atacante hacerse pasar tanto por nodos de cl\u00faster confiables como por cualquier usuario de API que use certificados de cliente TLS para autenticaci\u00f3n (objetos ApiUser con el atributo client_cn establecido). Esta vulnerabilidad se ha corregido en v2.14.3, v2.13.10, v2.12.11 y v2.11.12."}], "id": "CVE-2024-49369", "lastModified": "2026-06-17T07:59:46.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-49369", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-12T17:01:31.893265Z", "version": "2.0.3"}}]}, "published": "2024-11-12T17:15:08.250", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}