Icinga Web 2 Installer Exposure Detection

Icinga Web 2 installer/setup wizard is publicly accessible. The setup page at /icingaweb2/setup exposes the configuration wizard which guides through full application configuration including database credentials, authentication backends, and admin account creation. While a setup token is required...

PT-2018-14380

Name of the Vulnerable Software and Affected Versions Icinga Web 2 affected versions not specified Description The issue is related to XSS via several API endpoints, including "/icingaweb2/monitoring/list/services" with the dir parameter, "/icingaweb2/user/list" with the query string,...

CVE-2018-18248: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...