This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Icinga fixes 6 vulnerabilities

Icinga fixes 6 vulnerabilities in its products. The most severe ones are described below; the rest can be found at [1]. Products and their fixed versions: Icinga Web - 2.12.3 and 2.11.5 Icinga Director - 1.11.4 and 1.10.4 Icinga Reporting - 1.0.3

Icinga Web - XSS (CVE-2025-27404, CVE-2025-27405)
CVSS 8.3 (High)

An unauthenticated remote attacker can carry out an XSS attack on Icinga Web using social engineering and a specially crafted URL. For version 2.12.2, the risk can be temporarily mitigated by enabling Content Security Policy (CSP) in the application settings [1][2][3].

The vulnerability is present in product:

  • *:Icinga Web;<2.11.5;>=2.12.0,<=2.12.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

Icinga Reporting - XSS, SSRF (CVE-2025-27406)
CVSS 8.3 (High)

An unauthenticated remote attacker can carry out a stored XSS attack in Icinga Reporting using social engineering and a specially crafted template. The vulnerability can also be exploited automatically when the template is processed by a headless browser, if it is used to generate a PDF report, which can potentially lead to an SSRF attack. After updating to the fixed version, it is recommended to review all templates and remove any suspicious settings [1][4].

The vulnerability is present in product:

  • *:Icinga Reporting;>=0.10.0,<=1.0.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

Icinga Director - unauthorized access, information disclosure (CVE-2025-23203)
CVSS 5.5 (Medium)

An authenticated remote attacker with access to Icinga Director and its REST API can, on some endpoints, gain unauthorized access to specific objects (if they know their identifier) and modify their configuration [1][5]. If an immediate update to the fixed version is not possible, it is recommended to temporarily disable the Director module for all users except the administrator. A list of vulnerable endpoints can be found at [1].

The vulnerability is present in product:

  • *:Icinga Director;>=1.0.0,<1.10.3;>=1.11.0,<1.11.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 26. 3. 2025.

CESNET, z.s.p.o. Logo