Log in Start free

Vulnerability · Published Mar 26, 2025 · Assigned by GitHub_M

CVE-2025-27609Icinga Web 2 Vulnerable to Reflected XSS

Low 1.1

In plain English

A low-severity cross-site scripting in icingaweb2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)1.1Low
Exploit odds (30 days)0.3%top 83.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12icingaweb2no fix listedDEBIAN-CVE-2025-27609
Debian:13icingaweb22.12.4-1DEBIAN-CVE-2025-27609
Debian:14icingaweb22.12.4-1DEBIAN-CVE-2025-27609
Ubuntu:22.04:LTSicingaweb2no fix listedUBUNTU-CVE-2025-27609
Ubuntu:24.04:LTSicingaweb2no fix listedUBUNTU-CVE-2025-27609
Ubuntu:25.10icingaweb2no fix listedUBUNTU-CVE-2025-27609

Affected products (as reported)

VendorProductVersions
Icinga icingaweb2 < 2.11.5>= 2.12.0, < 2.12.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

References