ALPINE-CVE-2021-32746

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2021-32746
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2021-32746
Upstream
Published
2021-07-12T23:15:07Z
Modified
2026-11-03T06:32:58Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the doc module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator and users need explicit access permission to use it. Then, by visiting a certain route, it is possible to gain access to arbitrary files readable by the web-server user. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, an administrator may disable the doc module or revoke permission to use it from all users.

References

Affected packages

Alpine:v3.15
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.16
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.17
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.18
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.19
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.20
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.21
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.22
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.23
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"
Alpine:v3.24
icingaweb2

Package

Name
icingaweb2
Purl
pkg:apk/alpine/icingaweb2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-32746.json"