CVE-2025-53840

Katalog CVE

CVSS 2.4 · Low EPSS 0,28%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada icinga db web. Skor CVSS 3.1 2.4 (Low) menurut github.com.

Deskripsi (NVD)

Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.

Rincian

Terbit di NVD

16 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.4 (Low), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473 patch · advisory vendor
• https://github.com/Icinga/icingadb-web/releases/tag/v1.2.2 release notes