CVE-2025-27405: Icinga Web 2 has XSS in embedded content
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.11.5 - Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.12.3 - Configuration
For Icinga Web 2.12.2 only, enable a content security policy in the application settings as a workaround.
Icinga Web 2 Content Security Policy (CSP) in application settings = enable
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27405?
CVE-2025-27405 is classified as a medium severity vulnerability that allows for arbitrary JavaScript embedding.
How do I fix CVE-2025-27405?
To fix CVE-2025-27405, update Icinga Web 2 to versions 2.11.5 or 2.12.13 or later.
What can an attacker do with CVE-2025-27405?
An attacker can craft a URL that allows the embedding of arbitrary JavaScript within Icinga Web, which can be executed by users visiting the URL.
What versions of Icinga Web 2 are affected by CVE-2025-27405?
CVE-2025-27405 affects Icinga Web 2 versions prior to 2.11.5 and 2.12.13.
Is user authentication required to exploit CVE-2025-27405?
Exploitation of CVE-2025-27405 does not require user authentication, making it a critical concern.