Vulnerability · Published Mar 26, 2025 · Assigned by GitHub_M
CVE-2025-27405Icinga Web 2 has XSS in embedded content
High 7.7
In plain English
A high-severity cross-site scripting in icingaweb2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | icingaweb2 | no fix listed | DEBIAN-CVE-2025-27405 |
| Debian:13 | icingaweb2 | 2.12.4-1 | DEBIAN-CVE-2025-27405 |
| Debian:14 | icingaweb2 | 2.12.4-1 | DEBIAN-CVE-2025-27405 |
| Ubuntu:22.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2025-27405 |
| Ubuntu:24.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2025-27405 |
| Ubuntu:25.10 | icingaweb2 | no fix listed | UBUNTU-CVE-2025-27405 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Icinga | icingaweb2 | < 2.11.5>= 2.12.0, < 2.12.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-3x37-fjc3-ch8w x_refsource_CONFIRM
- https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 x_refsource_MISC
- https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 x_refsource_MISC