{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-49369",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-49369",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2024-11-12T16:44:01.713Z",
    "updatedAt": "2025-11-03T22:22:15.314Z",
    "importedAt": "2026-10-24T01:57:16.009Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections",
      "summary": "Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.",
      "affected": [
        {
          "vendor": "Icinga",
          "product": "icinga2",
          "versions": [
            {
              "version": ">= 2.4.0, < 2.11.12",
              "status": "affected"
            },
            {
              "version": ">= 2.12.0, < 2.12.11",
              "status": "affected"
            },
            {
              "version": ">= 2.13.0, < 2.13.10",
              "status": "affected"
            },
            {
              "version": ">= 2.14.0, < 2.14.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}