Icinga Web 2
Approved changes feed: RSS · Atom
cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Icinga (f3c2076d-deab-53f8-8d1d-6154f519c3cc) |
|---|---|
| Product | Icinga Web 2 (04455195-0787-5392-9041-8fb5d8365a8f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/icinga/icingaweb2 |
purl2cpe | 2026-06-01 10:11:13.991791 |
pkg:rpm/opensuse/icingaweb2 |
purl2cpe | 2026-06-01 10:11:13.991793 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-30164 |
vulnerable | 2026-06-08 07:16:59.157650 |
Icinga Web 2 has open redirect on login page
MEDIUM (4.1)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
Published: 2025-03-26T16:13:26.590Z
Updated: 2025-05-12T15:41:08.237Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27609 |
vulnerable | 2026-06-08 07:14:55.368783 |
Icinga Web 2 Vulnerable to Reflected XSS
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.
Published: 2025-03-26T16:10:19.223Z
Updated: 2025-03-26T18:05:36.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27405 |
vulnerable | 2026-06-08 07:14:54.893987 |
Icinga Web 2 has XSS in embedded content
HIGH (7.7)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Published: 2025-03-26T15:10:10.288Z
Updated: 2025-03-26T15:57:52.238Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27404 |
vulnerable | 2026-06-08 07:14:54.893485 |
Icinga Web 2 DOM-based XSS vulnerability
HIGH (7.7)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Published: 2025-03-26T14:21:05.363Z
Updated: 2025-03-26T15:10:01.679Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-49369 |
vulnerable | 2026-06-08 06:50:13.722882 |
Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
CRITICAL (9.8)
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
Published: 2024-11-12T16:44:01.713Z
Updated: 2025-11-03T22:22:15.314Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24716 |
vulnerable | 2026-06-08 05:41:01.419042 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24715 |
vulnerable | 2026-06-08 05:41:01.418580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24714 |
vulnerable | 2026-06-08 05:41:01.418024 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24368 |
vulnerable | 2026-06-08 05:22:32.882084 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18250 |
vulnerable | 2026-06-08 05:11:07.277548 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18249 |
vulnerable | 2026-06-08 05:11:07.277092 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18247 |
vulnerable | 2026-06-08 05:11:07.274858 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18246 |
vulnerable | 2026-06-08 05:11:07.274457 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.