Vulnerability · Published Mar 26, 2025 · Assigned by GitHub_M
CVE-2025-30164Icinga Web 2 has open redirect on login page
Medium 4.1
In plain English
A medium-severity open redirect in icingaweb2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | icingaweb2 | no fix listed | DEBIAN-CVE-2025-30164 |
| Debian:13 | icingaweb2 | 2.12.4-1 | DEBIAN-CVE-2025-30164 |
| Debian:14 | icingaweb2 | 2.12.4-1 | DEBIAN-CVE-2025-30164 |
| Ubuntu:22.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2025-30164 |
| Ubuntu:24.04:LTS | icingaweb2 | no fix listed | UBUNTU-CVE-2025-30164 |
| Ubuntu:25.10 | icingaweb2 | no fix listed | UBUNTU-CVE-2025-30164 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Icinga | icingaweb2 | < 2.11.5>= 2.12.0, < 2.12.3 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
References
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q x_refsource_CONFIRM
- https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 x_refsource_MISC
- https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 x_refsource_MISC