Description
Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | icinga | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Client Tools 12 | icinga | 1.13.3-12.3.1 | SUSE-SU-2018:3620-1 |
| SUSE Enterprise Storage 4 | icinga | 1.13.3-12.3.1 | SUSE-SU-2018:3620-1 |
Advisories 1
- SUSE-SU-2018:3620-1 Security update for icinga SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/Icinga/icinga-core/issues/1563
- [oss-security] 20151029 Re: CVE request - Icinga 1.13.3 and older are vulnerable to XSS mailing-list
- openSUSE-SU-2017:0146 vendor-advisory
- 97145 vdb-entry
- [oss-security] 20151023 CVE request - Icinga 1.13.3 and older are vulnerable to XSS mailing-list