CVE-2025-27405: icinga icinga_web_2 Cross-site Scripting
Vulnerability summary
CVE-2025-27405 is a high (CVSS 7.7) Cross-site Scripting vulnerability in icinga icinga_web_2. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 26-03-2025PublishedVulnerability first disclosed.
- 26-03-2025Last modifiedVulnerability information updated.
Description
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
+0.01 pp
From 0.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Icinga2 products
- icinga_web_2< 2.11.5 | ≥ 2.12.0, < 2.12.3
- icingaweb2< 2.11.5 | ≥ 2.12.0, < 2.12.3
Debian1 product
- icingaweb2All versions (No fix recorded) | < 2.12.4-1
Ubuntu1 product
- icingaweb2All versions (No fix recorded)
3 vendors · 4 products
References
6 links- github.com/Icinga/icingaweb2/security/advisories/GHSA-3x37-fjc3-ch8wX Refsource CONFIRMVendor Advisory
