PT-2025-42511 · Icinga 2+1 · Icinga 2+1

Published 2025-10-16 · Updated 2025-11-26 · CVE-2025-61907

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.4 through 2.15.0

Description Icinga 2 is an open source monitoring system. Filter expressions provided to the /v1/objects API endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions.

Recommendations Update to Icinga 2 version 2.15.1. Update to Icinga 2 version 2.14.7. Update to Icinga 2 version 2.13.13.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-204

CWE-749

CWE-200

Related Identifiers

CVE-2025-61907

GHSA-GG32-W9RM-VP2V

OPENSUSE-SU-2025:15644-1

Affected Products

Debian

Icinga 2

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61907.json · Exploit
• https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v · Vendor Advisory
• https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3 · Patch
• https://osv.dev/vulnerability/CVE-2025-61907 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61907 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61907 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15644-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61907 · Security Note
• https://ubuntu.com/security/CVE-2025-61907 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61907 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61907 · Vendor Advisory
• https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4 · Note
• https://suse.com/security/cve/CVE-2025-61909 · Note
• https://t.me/cveNotify/144086 · Telegram Post
• https://suse.com/security/cve/CVE-2025-61908 · Note