CyberRota Analysis
AI-GeneratedIcinga 2 versions 2.4 through 2.14.9, 2.15.4, and 2.16.2 are vulnerable due to an API flaw that allows authenticated users with specific permissions to inject unescaped template names into the configuration, potentially leading to privilege escalation and unauthorized object creation. Organizations using these versions should prioritize updating to the patched releases (2.14.9, 2.15.4, or 2.16.2) to mitigate the risk of exploitation. This vulnerability is particularly critical for environments where Icinga 2 is used for monitoring and managing infrastructure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.