CVE-2025-27405: Icinga Web 2 has XSS in embedded content
First published: Wed Mar 26 2025(Updated: )
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icinga Web 2 | <2.11.5<2.12.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-27405?
CVE-2025-27405 is classified as a medium severity vulnerability that allows for arbitrary JavaScript embedding.
How do I fix CVE-2025-27405?
To fix CVE-2025-27405, update Icinga Web 2 to versions 2.11.5 or 2.12.13 or later.
What can an attacker do with CVE-2025-27405?
An attacker can craft a URL that allows the embedding of arbitrary JavaScript within Icinga Web, which can be executed by users visiting the URL.
What versions of Icinga Web 2 are affected by CVE-2025-27405?
CVE-2025-27405 affects Icinga Web 2 versions prior to 2.11.5 and 2.12.13.
Is user authentication required to exploit CVE-2025-27405?
Exploitation of CVE-2025-27405 does not require user authentication, making it a critical concern.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/references
- agent/title
- collector/nvd-api
- source/NVD
- agent/event
- agent/severity
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/icinga
- canonical/icinga web 2