Skip to content
OpenAdvisories
Medium WID-SEC-2025-0639 6 CVEs

Icinga: Mehrere Schwachstellen

Published Mar 25, 2025 · Updated Dec 17, 2025 · Revision 2 · de-DE

Vendor: SUSE Product: openSUSE Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Icinga ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.

Product

Icinga ist ein Monitoring System.

Vulnerabilities 6

  • High 7.7
    CVE-2025-27404

    Icinga Web 2 DOM-based XSS vulnerability

    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into …

    Icinga icingaweb2 icingaweb2 icingaweb2 Debian Ubuntu
  • High 7.7
    CVE-2025-27405

    Icinga Web 2 has XSS in embedded content

    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into …

    Icinga icingaweb2 icingaweb2 icingaweb2 Debian Ubuntu
  • High 7.7
    CVE-2025-27406

    Icinga Reporting Stored XSS leads to SSRF

    Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javasc…

    Icinga icingaweb2-module-reporting icingaweb2-module-reporting icingaweb2-module-reporting Debian Ubuntu
  • Medium 5.5
    CVE-2025-23203

    Icinga has rest API endpoints accessible to restricted users

    Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permiss…

    Icinga icingaweb2-module-director icingaweb2-module-director icingaweb2-module-director Debian Ubuntu
  • Medium 4.1
    CVE-2025-30164

    Icinga Web 2 has open redirect on login page

    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is …

    Icinga icingaweb2 icingaweb2 icingaweb2 Debian Ubuntu
  • Low 1.1
    CVE-2025-27609

    Icinga Web 2 Vulnerable to Reflected XSS

    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbit…

    Icinga icingaweb2 icingaweb2 icingaweb2 Debian Ubuntu

Revision history

  1. #2

    Neue Updates von openSUSE aufgenommen

  2. #1

    Initiale Fassung

References