PT-2025-12889 · Icinga+2 · Icinga Director+2

Published 2025-03-26 · Updated 2026-01-20 · CVE-2025-23203

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Icinga Director versions 1.0.0 through 1.10.2 Icinga Director versions 1.0.0 through 1.11.2

Description A security issue has been found in Icinga Director, affecting several REST API endpoints. This issue allows authenticated users with permission to access the Director to retrieve information related to certain objects, even if they are restricted from accessing them. The affected endpoints include "icingaweb2/director/service", "icingaweb2/director/notification", "icingaweb2/director/serviceset", and "icingaweb2/director/scheduled-downtime". Additionally, the endpoint icingaweb2/director/services?host=filteredHostName returns a status code 200, indicating the existence of a host, even if the user is restricted from accessing it. This could result in further exploitation and data breaches.

Recommendations For Icinga Director versions 1.0.0 through 1.10.2, update to version 1.10.3 or later. For Icinga Director versions 1.0.0 through 1.11.2, update to version 1.11.1 or later. As a temporary workaround, consider disabling the director module for users other than the admin role until a patch is applied.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

ALT-PU-2025-10629

CVE-2025-23203

GHSA-3233-GGC5-M3QG

Affected Products

Alt Linux

Debian

Icinga Director

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23203.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-23203 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-23203 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23203 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23203 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-23203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23203 · Security Note
• https://ubuntu.com/security/CVE-2025-23203 · Vendor Advisory
• https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.11.3 · Note
• https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.10.3 · Note
• https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.10.4 · Note
• https://github.com/Icinga/icingaweb2-module-director/commit/3fcb20178ff1722329bf8689795e6cc8e53a9978 · Note
• https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.11.4 · Note
• https://github.com/Icinga/icingaweb2-module-director/commit/8d9ecf3b0a852aa2a756c518ef4f29db9ca0f9ee · Note
• https://github.com/Icinga/icingaweb2-module-director/security/advisories/GHSA-3233-ggc5-m3qg · Note