CVE-2020-24368 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-24368 Interim 1 14 2023-09-06T23:56:33Z current 2021-05-30T14:43:36Z 2023-09-06T23:56:33Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-24368 Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00026.html E-Mail link for openSUSE-SU-2020:1674-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub 12 SUSE Package Hub 15 SP1 SUSE Package Hub 15 SP2 openSUSE Leap 15.1 openSUSE Leap 15.2 openSUSE Tumbleweed icingacli-2.7.4-12.1 icingacli-2.7.4-bp151.5.6.1 icingacli-2.7.4-bp152.2.3.1 icingacli-2.7.4-lp151.6.8.1 icingacli-2.7.4-lp152.2.3.1 icingacli-2.8.4-1.6 icingaweb2-2.7.4-12.1 icingaweb2-2.7.4-bp151.5.6.1 icingaweb2-2.7.4-bp152.2.3.1 icingaweb2-2.7.4-lp151.6.8.1 icingaweb2-2.7.4-lp152.2.3.1 icingaweb2-2.8.4-1.6 icingaweb2-common-2.7.4-12.1 icingaweb2-common-2.7.4-bp151.5.6.1 icingaweb2-common-2.7.4-bp152.2.3.1 icingaweb2-common-2.7.4-lp151.6.8.1 icingaweb2-common-2.7.4-lp152.2.3.1 icingaweb2-common-2.8.4-1.6 icingaweb2-vendor-HTMLPurifier-2.7.4-12.1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp151.5.6.1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp152.2.3.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp151.6.8.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp152.2.3.1 icingaweb2-vendor-HTMLPurifier-2.8.4-1.6 icingaweb2-vendor-JShrink-2.7.4-12.1 icingaweb2-vendor-JShrink-2.7.4-bp151.5.6.1 icingaweb2-vendor-JShrink-2.7.4-bp152.2.3.1 icingaweb2-vendor-JShrink-2.7.4-lp151.6.8.1 icingaweb2-vendor-JShrink-2.7.4-lp152.2.3.1 icingaweb2-vendor-JShrink-2.8.4-1.6 icingaweb2-vendor-Parsedown-2.7.4-12.1 icingaweb2-vendor-Parsedown-2.7.4-bp151.5.6.1 icingaweb2-vendor-Parsedown-2.7.4-bp152.2.3.1 icingaweb2-vendor-Parsedown-2.7.4-lp151.6.8.1 icingaweb2-vendor-Parsedown-2.7.4-lp152.2.3.1 icingaweb2-vendor-Parsedown-2.8.4-1.6 icingaweb2-vendor-dompdf-2.7.4-12.1 icingaweb2-vendor-dompdf-2.7.4-bp151.5.6.1 icingaweb2-vendor-dompdf-2.7.4-bp152.2.3.1 icingaweb2-vendor-dompdf-2.7.4-lp151.6.8.1 icingaweb2-vendor-dompdf-2.7.4-lp152.2.3.1 icingaweb2-vendor-dompdf-2.8.4-1.6 icingaweb2-vendor-lessphp-2.7.4-12.1 icingaweb2-vendor-lessphp-2.7.4-bp151.5.6.1 icingaweb2-vendor-lessphp-2.7.4-bp152.2.3.1 icingaweb2-vendor-lessphp-2.7.4-lp151.6.8.1 icingaweb2-vendor-lessphp-2.7.4-lp152.2.3.1 icingaweb2-vendor-lessphp-2.8.4-1.6 icingaweb2-vendor-zf1-2.7.4-12.1 icingaweb2-vendor-zf1-2.7.4-bp151.5.6.1 icingaweb2-vendor-zf1-2.7.4-bp152.2.3.1 icingaweb2-vendor-zf1-2.7.4-lp151.6.8.1 icingaweb2-vendor-zf1-2.7.4-lp152.2.3.1 icingaweb2-vendor-zf1-2.8.4-1.6 php-Icinga-2.7.4-12.1 php-Icinga-2.7.4-bp151.5.6.1 php-Icinga-2.7.4-bp152.2.3.1 php-Icinga-2.7.4-lp151.6.8.1 php-Icinga-2.7.4-lp152.2.3.1 php-Icinga-2.8.4-1.6 icingacli-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-common-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-vendor-HTMLPurifier-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-vendor-JShrink-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-vendor-Parsedown-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-vendor-dompdf-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-vendor-lessphp-2.7.4-12.1 as a component of SUSE Package Hub 12 icingaweb2-vendor-zf1-2.7.4-12.1 as a component of SUSE Package Hub 12 php-Icinga-2.7.4-12.1 as a component of SUSE Package Hub 12 icingacli-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-common-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-vendor-HTMLPurifier-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-vendor-JShrink-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-vendor-Parsedown-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-vendor-dompdf-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-vendor-lessphp-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingaweb2-vendor-zf1-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 php-Icinga-2.7.4-bp151.5.6.1 as a component of SUSE Package Hub 15 SP1 icingacli-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-common-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-vendor-HTMLPurifier-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-vendor-JShrink-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-vendor-Parsedown-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-vendor-dompdf-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-vendor-lessphp-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingaweb2-vendor-zf1-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 php-Icinga-2.7.4-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2 icingacli-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-common-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-vendor-HTMLPurifier-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-vendor-JShrink-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-vendor-Parsedown-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-vendor-dompdf-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-vendor-lessphp-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingaweb2-vendor-zf1-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 php-Icinga-2.7.4-lp151.6.8.1 as a component of openSUSE Leap 15.1 icingacli-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-common-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-vendor-HTMLPurifier-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-vendor-JShrink-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-vendor-Parsedown-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-vendor-dompdf-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-vendor-lessphp-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingaweb2-vendor-zf1-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 php-Icinga-2.7.4-lp152.2.3.1 as a component of openSUSE Leap 15.2 icingacli-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-common-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-vendor-HTMLPurifier-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-vendor-JShrink-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-vendor-Parsedown-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-vendor-dompdf-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-vendor-lessphp-2.8.4-1.6 as a component of openSUSE Tumbleweed icingaweb2-vendor-zf1-2.8.4-1.6 as a component of openSUSE Tumbleweed php-Icinga-2.8.4-1.6 as a component of openSUSE Tumbleweed Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2. CVE-2020-24368 SUSE Package Hub 12:icingacli-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-common-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.4-12.1 SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.4-12.1 SUSE Package Hub 12:php-Icinga-2.7.4-12.1 SUSE Package Hub 15 SP1:icingacli-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-common-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP1:php-Icinga-2.7.4-bp151.5.6.1 SUSE Package Hub 15 SP2:icingacli-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-common-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-vendor-HTMLPurifier-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-vendor-JShrink-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-vendor-Parsedown-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-vendor-dompdf-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-vendor-lessphp-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:icingaweb2-vendor-zf1-2.7.4-bp152.2.3.1 SUSE Package Hub 15 SP2:php-Icinga-2.7.4-bp152.2.3.1 openSUSE Leap 15.1:icingacli-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-common-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.4-lp151.6.8.1 openSUSE Leap 15.1:php-Icinga-2.7.4-lp151.6.8.1 openSUSE Leap 15.2:icingacli-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-common-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-vendor-HTMLPurifier-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-vendor-JShrink-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-vendor-Parsedown-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-vendor-dompdf-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-vendor-lessphp-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:icingaweb2-vendor-zf1-2.7.4-lp152.2.3.1 openSUSE Leap 15.2:php-Icinga-2.7.4-lp152.2.3.1 openSUSE Tumbleweed:icingacli-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-common-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-vendor-HTMLPurifier-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-vendor-JShrink-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-vendor-Parsedown-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-vendor-dompdf-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-vendor-lessphp-2.8.4-1.6 openSUSE Tumbleweed:icingaweb2-vendor-zf1-2.8.4-1.6 openSUSE Tumbleweed:php-Icinga-2.8.4-1.6 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N