CVE-2021-32743
What it is
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding object types. IdoMysqlConnection and IdoPgsqlConnection (every released version) exposes the password of the user used to connect to the database. IcingaDB (added in 2.12.0) exposes the password used to connect to the Redis server. ElasticsearchWriter (added in 2.8.0)exposes the password used to connect to the Elasticsearch server. An attacker who obtains these credentials can impersonate Icinga to these services and add, modify and delete information there. If credentials with more permissions are in use, this increases the impact accordingly. Starting with the 2.11.10 and 2.12.5 releases, these passwords are no longer exposed via the API. As a workaround, API user permissions can be restricted to not allow querying of any affected objects, either by explicitly listing only the required object types for object query permissions, or by applying a filter rule.
At a glance
- Exploitability
- Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 1.8% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 1.8% in the next 30 days (EPSS).
- Severity: 8.8 HIGH (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 1.8% · EPSS, next 30 days
- Weakness
- CWE-202
- Record status
- Modified
Affected
- Icinga < 2.11.10
- Icinga < 2.12.5
- Debian Linux 9.0
Attack profile CVSS 3.1 · 8.8
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2021-32743.md and follow it. Check whether this project is affected by CVE-2021-32743. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7
- https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7
- https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/
References
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7
- https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/
- https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html
- https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7
- https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/
- https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html
- https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html