We fixed two security vulnerabilities related to the web interface.
They were related to the cross-site request forgery attack and the clickjacking attack.
Both are used to induce users to perform actions that they do not intend to perform by hiding the NetEye web interface under some eye-catching pages or with some malicious links sent for example by email.
More information on how the vulnerabilities work can be found here:
Furthermore, we fixed a bug related to the users SSO in the ITOA module. When the users belonged to teams of different organizations, the teams were not correctly assigned.
For NetEye 4.17 we updated the following packages:
- httpd-neteye-config and httpd-neteye-config-autosetup to version 1.9.1-1
- icingaweb2-module-analytics and icingaweb2-module-analytics-autosetup to version 1.38.1-1
Mattia Codato
Software Developer - IT System & Service Management Solutions at Würth Phoenix
Author
Latest posts by Mattia Codato
11. 02. 2025
Development, Events, NetEye
Podman Quadlet: Simplifying Container Management with systemd
18. 12. 2024
Automation, Development, DevOps
GitOps: Push vs Pull? Choosing the Right Approach for Production Deployments
25. 11. 2024
ctf-writeups, Events
WP CTF 2024: Another Successful Edition!
14. 11. 2024
Bug Fixes
NetEye 4 – Security Advisory