CVE-2025-27404: Icinga Web 2 DOM-based XSS vulnerability
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.11.5 - Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.12.3 - Configuration
As a workaround for Icinga Web 2.12.2, enable a Content Security Policy in the application settings to mitigate embedding arbitrary JavaScript.
Icinga Web 2 Content Security Policy (Content Security Policy) in application settings = enable
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27404?
CVE-2025-27404 has a moderate severity level due to the potential for arbitrary JavaScript execution in Icinga Web 2.
How do I fix CVE-2025-27404?
To fix CVE-2025-27404, upgrade Icinga Web 2 to version 2.11.5 or 2.12.13 or later.
What versions of Icinga Web 2 are affected by CVE-2025-27404?
CVE-2025-27404 affects Icinga Web 2 versions prior to 2.11.5 and 2.12.13.
What impact does CVE-2025-27404 have on users?
CVE-2025-27404 allows an attacker to embed arbitrary JavaScript into the Icinga Web interface, potentially compromising user accounts.
Is CVE-2025-27404 present in the latest version of Icinga Web 2?
No, CVE-2025-27404 is not present in Icinga Web 2 versions 2.11.5 and 2.12.13 or later.