CVE-2024-24820

Summary

CVE-2024-24820 is a newly disclosed vulnerability affecting Icinga Director, a configuration handling tool for Icinga 2. The vulnerability involves unprotected forms against Cross-Site Request Forgery (CSRF), allowing attackers to manipulate the monitoring environment managed by Icinga Director without the user's knowledge. The map module in version 1.x is particularly affected, and users are urged to upgrade to version 2.0. Additionally, upgrades to the most recent releases of the 2.9, 2.10, or 2.11 branch are necessary if not already done. Icinga Director will receive updates for versions 1.8, 1.9, 1.10, and 1.11 to address this issue. Users should upgrade to a patched release immediately, or disable the director module as a temporary measure if an upgrade is not feasible. Previously reported XSS vulnerabilities in Icinga Web have already been addressed through updates.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.