PHP ini-file Directive Injection in Icinga Web 2 by Icinga
CVE-2018-18249

9.8CRITICAL

Key Information:

Vendor: Icinga
Status: Icinga Web 2
Vendor: CVE Published:; 17 December 2018

What is CVE-2018-18249?

Icinga Web 2 versions prior to 2.6.2 are susceptible to a vulnerability that allows attackers to inject malicious PHP ini-file directives using environment variables. By manipulating parameters such as name=${PATH}${APACHE_RUN_DIR}${APACHE_RUN_USER}, an attacker can alter behavior and gain unauthorized access to sensitive information through affected routes like /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet. It's crucial for users of Icinga Web 2 to implement necessary updates and security measures to protect against these injection attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch