CVE-2025-27404: icinga icinga_web_2 Cross-site Scripting
Vulnerability summary
CVE-2025-27404 is a high (CVSS 7.7) Cross-site Scripting vulnerability in icinga icinga_web_2. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 26-03-2025PublishedVulnerability first disclosed.
- 26-03-2025Last modifiedVulnerability information updated.
Description
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.02 pp
From 0.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Icinga2 products
- icinga_web_2< 2.11.5 | ≥ 2.12.0, < 2.12.3
- icingaweb2< 2.11.5 | ≥ 2.12.0, < 2.12.3
Debian1 product
- icingaweb2All versions (No fix recorded) | < 2.12.4-1
Ubuntu1 product
- icingaweb2All versions (No fix recorded)
3 vendors · 4 products
References
6 links- github.com/Icinga/icingaweb2/security/advisories/GHSA-c6pg-h955-wf66X Refsource CONFIRMVendor Advisory
