CVE-2025-27609: icinga web 2

csirt@kutim:~/threat-intel/cve/CVE-2025-27609

CVSS 5.4 · Medium EPSS 0,25%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada icinga web 2. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.

Rincian

Terbit di NVD: 26 Maret 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
icinga	icinga web 2	Semua versi sebelum 2.11.5
icinga	icinga web 2	Versi 2.12.0 hingga sebelum 2.12.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5cjw-fwjc-8j38 advisory vendor
https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 release notes
https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.