PT-2025-29826 · Unknown · Icinga Db Web

Nilmerg · Published 2025-07-16 · Updated 2025-12-11 · CVE-2025-53840

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Icinga DB Web versions 1.2.0 through 1.2.1

Description Icinga DB Web, a graphical interface for Icinga monitoring, allows users with access to Icinga Dependency Views to view hosts and services they are not authorized to access on the dependency map. The name of the object is not revealed, and access to detail views is not granted. This issue affects the filter/hosts and filter/services restrictions.

Recommendations Downgrade to version 1.1.3. Update to version 1.2.2.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-53840

GHSA-Q2W7-MRX8-5473

Affected Products

Icinga Db Web

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53840.json · Exploit
• https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53840 · Security Note
• https://github.com/Icinga/icingadb-web/releases/tag/v1.2.2 · Note
• https://twitter.com/CVEnew/status/1945482455601037787 · Twitter Post
• https://t.me/cveNotify/145487 · Telegram Post
• https://twitter.com/dailycve/status/1999208234310095277 · Twitter Post
• https://t.me/cvetracker/27961 · Telegram Post