Arbitrary Code Execution Vulnerability in Icinga by Icinga Software
CVE-2018-6533

7.8HIGH

Key Information:

Vendor

Icinga

Status
Icinga
Vendor
CVE Published:
27 February 2018

What is CVE-2018-6533?

A vulnerability in Icinga 2.x versions up to 2.8.1 allows for arbitrary code execution through the manipulation of the init.conf file. When configured improperly, this flaw enables an attacker to run Icinga as root, potentially leading to significant security breaches. This is a serious consideration for users of Icinga, as it can expose systems to run malicious code with root privileges. The vulnerability was addressed by modifying how account information is determined, eliminating the reliance on init.conf for any root-executed code.

References

https://github.com/Icinga/icinga2/pull/5850
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.