CVE-2025-27404: Icinga Web 2 DOM-based XSS vulnerability
First published: Wed Mar 26 2025(Updated: )
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icinga Web 2 | <2.11.5<2.12.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-27404?
CVE-2025-27404 has a moderate severity level due to the potential for arbitrary JavaScript execution in Icinga Web 2.
How do I fix CVE-2025-27404?
To fix CVE-2025-27404, upgrade Icinga Web 2 to version 2.11.5 or 2.12.13 or later.
What versions of Icinga Web 2 are affected by CVE-2025-27404?
CVE-2025-27404 affects Icinga Web 2 versions prior to 2.11.5 and 2.12.13.
What impact does CVE-2025-27404 have on users?
CVE-2025-27404 allows an attacker to embed arbitrary JavaScript into the Icinga Web interface, potentially compromising user accounts.
Is CVE-2025-27404 present in the latest version of Icinga Web 2?
No, CVE-2025-27404 is not present in Icinga Web 2 versions 2.11.5 and 2.12.13 or later.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- collector/nvd-api
- source/NVD
- agent/source
- agent/last-modified-date
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/icinga
- canonical/icinga web 2