Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
References
| Link | Resource |
|---|---|
| https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 | Release Notes |
| https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 | Release Notes |
| https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Aug 2025, 15:02
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Icinga icinga Web 2
Icinga |
|
| CPE | cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q - Vendor Advisory | |
| References | () https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3 - Release Notes | |
| References | () https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 - Release Notes |
26 Mar 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-26 17:15
Updated : 2025-08-01 15:02
NVD link : CVE-2025-30164
Mitre link : CVE-2025-30164
JSON object : View
Products Affected
icinga
- icinga_web_2
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')