CyberRota Analysis
AI analysis pending.
CVE
CVE-2018-18249
Severity
CRITICAL
CVSS
9.8
EPSS
1.49%
Apache
Original NVD Description
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.
Related CVEs
Other vulnerabilities affecting the same vendor(s)