PT-2025-12974 · Icinga+2 · Icinga Web 2+2

Moezbouzayani9 · Publicado 2025-03-26 · Atualizado 2025-08-21 · CVE-2025-27609

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.13

Description A vulnerability in Icinga Web 2 allows an attacker to craft a request that embeds arbitrary Javascript into the interface, enabling them to act on behalf of a user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. Modern browsers with a working CORS implementation sufficiently guard against the vulnerability.

Recommendations For versions prior to 2.11.5, update to version 2.11.5 or later. For versions prior to 2.12.13, update to version 2.12.3 or later. As a temporary workaround for version 2.12.2, enable a content security policy in the application settings.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2025-10627

CVE-2025-27609

GHSA-5CJW-FWJC-8J38

OPENSUSE-SU-2025:14931-1

Produtos afetados

Alt Linux

Debian

Icinga Web 2

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27609.json · Exploit
• https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 · Nota
• https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 · Nota
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5cjw-fwjc-8j38 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2025:14931-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-27609 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27609 · Aviso do Fabricante
• https://t.me/cvedetector/21214 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2025-30164 · Nota
• https://t.me/cvetracker/19983 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2025-27609 · Nota
• https://ubuntu.com/security/CVE-2025-27609 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-27404 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-27609 · Nota de Segurança
• https://suse.com/security/cve/CVE-2025-27405 · Nota