Cross-Site Scripting Vulnerability in Icinga Web 2 by Icinga

CVE-2025-27405

What is CVE-2025-27405?

Icinga Web 2, an open-source monitoring solution, has a vulnerability that allows attackers to construct a malicious URL. When accessed by any user, this URL may result in the injection of arbitrary JavaScript into the interface, potentially allowing an attacker to perform actions on behalf of the affected user. It is crucial for users on versions before 2.11.5 and 2.12.3 to update to the latest versions for protection. As a temporary measure, users of version 2.12.2 can implement a content security policy in their application settings to mitigate risks.

References