CVE-2024-49369

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-49369

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

cinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

References
Link Resource
https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c Patch
https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 Patch
https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe Patch
https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 Patch
https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 Patch
https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv Patch Vendor Advisory
https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3 Release Notes
https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

26 Nov 2025, 13:01

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
First Time Debian
Debian debian Linux

26 Nov 2025, 12:50

Type Values Removed Values Added
References () https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c - () https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c - Patch
References () https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 - () https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 - Patch
References () https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe - () https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe - Patch
References () https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 - () https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 - Patch
References () https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 - () https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 - Patch
References () https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv - () https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv - Patch, Vendor Advisory
References () https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3 - () https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3 - Release Notes
References () https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html - () https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html - Mailing List, Third Party Advisory
First Time Icinga
Icinga icinga
CPE cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*

03 Nov 2025, 23:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html -

13 Nov 2024, 17:01

Type Values Removed Values Added
Summary
  • (es) Icinga es un sistema de monitoreo que verifica la disponibilidad de los recursos de red, notifica a los usuarios sobre interrupciones y genera datos de rendimiento para informes. La validación del certificado TLS en todas las versiones de Icinga 2 a partir de la 2.4.0 tenía fallas, lo que permitía a un atacante hacerse pasar tanto por nodos de clúster confiables como por cualquier usuario de API que use certificados de cliente TLS para autenticación (objetos ApiUser con el atributo client_cn establecido). Esta vulnerabilidad se ha corregido en v2.14.3, v2.13.10, v2.12.11 y v2.11.12.

12 Nov 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-12 17:15

Updated : 2025-11-26 13:01

NVD link : CVE-2024-49369

Mitre link : CVE-2024-49369

CVE.ORG link : CVE-2024-49369

JSON object : View

Products Affected

debian

icinga

CWE
CWE-295

Improper Certificate Validation