Vulnerability Details CVE-2012-3441
The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 68.4%
CVSS Severity
CVSS v2 Score 7.5
References
- http://lists.opensuse.org/opensuse-updates/2012-08/msg00012.html
- http://www.openwall.com/lists/oss-security/2012/07/30/6
- http://www.openwall.com/lists/oss-security/2012/07/30/7
- https://bugzilla.novell.com/show_bug.cgi?id=767319
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78874
- https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=712813d3118a5b9e5a496179cab81dbe91f69d63
- https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=dcd45fb6931c4abf710829bee21af09f842bc281
- https://git.icinga.org/?p=icinga-doc.git%3Ba=commitdiff%3Bh=619a08ca1178144b8a3a5caafff32a2d3918edab
- http://lists.opensuse.org/opensuse-updates/2012-08/msg00012.html
- http://www.openwall.com/lists/oss-security/2012/07/30/6
- http://www.openwall.com/lists/oss-security/2012/07/30/7
- https://bugzilla.novell.com/show_bug.cgi?id=767319
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78874
- https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=712813d3118a5b9e5a496179cab81dbe91f69d63
- https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=dcd45fb6931c4abf710829bee21af09f842bc281
- https://git.icinga.org/?p=icinga-doc.git%3Ba=commitdiff%3Bh=619a08ca1178144b8a3a5caafff32a2d3918edab