This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-18246 →

DEBIAN-CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/mo...

Original description

The description as published by the source.

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 icingaweb2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]

Debian:13 icingaweb2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]

Debian:14 icingaweb2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]

References

advisory security-tracker.debian.org