Icingaweb2
Approved changes feed: RSS · Atom
cpe:2.3:a:icinga:icingaweb2:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Icinga (f3c2076d-deab-53f8-8d1d-6154f519c3cc) |
|---|---|
| Product | Icingaweb2 (9cf8ffd0-808e-565c-a936-533f8ea43f20) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-30164 |
vulnerable | 2026-06-08 07:16:59.155483 |
Icinga Web 2 has open redirect on login page
MEDIUM (4.1)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
Published: 2025-03-26T16:13:26.590Z
Updated: 2025-05-12T15:41:08.237Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27609 |
vulnerable | 2026-06-08 07:14:55.368738 |
Icinga Web 2 Vulnerable to Reflected XSS
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.
Published: 2025-03-26T16:10:19.223Z
Updated: 2025-03-26T18:05:36.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27405 |
vulnerable | 2026-06-08 07:14:54.893943 |
Icinga Web 2 has XSS in embedded content
HIGH (7.7)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Published: 2025-03-26T15:10:10.288Z
Updated: 2025-03-26T15:57:52.238Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27404 |
vulnerable | 2026-06-08 07:14:54.892375 |
Icinga Web 2 DOM-based XSS vulnerability
HIGH (7.7)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Published: 2025-03-26T14:21:05.363Z
Updated: 2025-03-26T15:10:01.679Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24716 |
vulnerable | 2026-06-08 05:41:01.419008 |
Path traversal in Icinga Web 2
HIGH (7.5)
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
Published: 2022-03-08T00:00:00.000Z
Updated: 2025-04-23T18:58:45.413Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24715 |
vulnerable | 2026-06-08 05:41:01.418538 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24714 |
vulnerable | 2026-06-08 05:41:01.416703 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32747 |
vulnerable | 2026-06-08 05:32:07.943619 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32746 |
vulnerable | 2026-06-08 05:32:07.943094 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.