PT-2025-42499 · Unknown+1 · Icinga Db Web+1

Published 2025-10-16 · Updated 2025-12-11 · CVE-2025-61789

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Icinga DB Web versions prior to 1.1.4 Icinga DB Web versions prior to 1.2.3

Description Icinga DB Web offers a graphical interface for Icinga monitoring. An authorized user with access to Icinga DB Web can utilize a custom variable within a filter—even if that variable is protected or hidden—to deduce its assigned values. Versions 1.1.4 and 1.2.3 prevent this by returning an error when such a custom variable is used.

Recommendations Update Icinga DB Web to version 1.1.4 or later. Update Icinga DB Web to version 1.2.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-61789

GHSA-W57J-28JC-8429

Affected Products

Debian

Icinga Db Web

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61789.json · Exploit
• https://github.com/Icinga/icingadb-web/commit/5e982dad40ec379075307ab1693580138e675b18 · Patch
• https://github.com/Icinga/icingadb-web/security/advisories/GHSA-w57j-28jc-8429 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61789 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61789 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61789 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61789 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61789 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61789 · Vendor Advisory
• https://twitter.com/dailycve/status/1999208642499772564 · Twitter Post
• https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4 · Note
• https://twitter.com/CVEnew/status/1978926579427221772 · Twitter Post
• https://t.me/CVEtracker/35113 · Telegram Post