CVE-2020-24368

Summary: CVE-2020-24368 affects Icinga Web 2 (Icinga Web2) versions 2.0.0–2.6.4, 2.7.4 and 2.8.2, via a directory traversal vulnerability that allows access to arbitrary files readable by the web process. The issue is fixed in the same product series at versions 2.6.4, 2.7.4 and 2.8.2. Impact (as...

CVE-2022-24716

CVE-2022-24716 affects Icinga Web 2: Unauthenticated arbitrary file disclosure via directory traversal in the web interface, exposed through the icinga-php-thirdparty/library paths. Root cause: directory traversal allowing access to local files (e.g., icingaweb2 config with DB credentials). Impac...

CVE-2022-24715

CVE-2022-24715 affects Icinga Web 2. Authenticated users with access to the configuration can create SSH resource files in unintended directories, enabling arbitrary code execution. The issue is fixed in Icinga Web 2 releases 2.8.6, 2.9.6, and 2.10. Upgrading is the recommended remediation; if up...

CVE-2018-18247

CVE-2018-18247 affects Icinga Web 2 prior to 2.6.2, where an XSS vulnerability exists via the /icingaweb2/navigation/add icon parameter. Exploitation details are documented across multiple feeds (e.g., SUSE/OpenSUSE security advisories) and OSV/OpenVAS/NVD entries corroborate the issue. The pract...

CVE-2018-18248

CVE-2018-18248 affects Icinga Web 2 and enables XSS via multiple user-controllable inputs: the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, and the /icingaweb2/setup query string. The connected docume...

CVE-2018-18246

Icinga Web 2 prior to version 2.6.2 is vulnerable to CSRF via modules control endpoints: /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module and /icingaweb2/config/moduleenable?name=setup to enable the setup module. This can be exploited to alter module state without...

CVE-2022-24714

CVE-2022-24714 affects Icinga Web 2 installations with the IDO writer enabled. The vulnerability stems from using service custom variables in role restrictions, which can allow users with specific roles to access a collection of content, if those roles granted access to hosts via at least one ser...

CVE-2018-18249

Icinga Web 2 before 2.6.2 is vulnerable to injection of PHP ini-file directives via environment-variable-based channels used as a conduit to exfiltrate information against endpoints such as /icingaweb2/navigation/add and /icingaweb2/dashboard/new-dashlet. Root cause: lack of input validation for ...

CVE-2018-18250

CVE-2018-18250 affects Icinga Web 2 prior to version 2.6.2, where crafted navigation item names (notably a single '$') can break navigation dashlets. The issue is documented across multiple sources tied to Icinga Web 2, including openSUSE/SUSE advisories and OSS/OSS-related bulletins, indicating ...

CVE-2025-27609

Icinga Web 2 contains a reflected XSS vulnerability (CVE-2025-27609) in versions prior to 2.11.5 and 2.12.13, allowing an attacker to craft a request that injects JavaScript and acts on behalf of the user. OpenSUSE SUSE and other feeds document ongoing fixes; migration paths include upgrading to ...

CVE-2025-27405

Icinga Web 2 contains a cross-site scripting vulnerability (CVE-2025-27405) where an attacker can craft a URL that, when visited by a user, can embed arbitrary JavaScript and act on behalf of that user. Affected versions are prior to 2.11.5 and 2.12.13; the issue is fixed in 2.11.5 and 2.12.3. As...

CVE-2025-27404

Icinga Web 2 is affected by CVE-2025-27404. Affected versions are prior to 2.11.5 and 2.12.13, where an attacker can craft a URL that, when visited by any user, allows embedding arbitrary JavaScript into Icinga Web and acting on behalf of that user. The issue is mitigated by upgrading to 2.11.5 o...

CVE-2025-30164

The CVE-2025-30164 issue in Icinga Web 2 is an open redirect vulnerability affecting versions before 2.11.5 and 2.12.13, where an authenticated (or easily authenticated) user could be redirected to an arbitrary location via a crafted URL. The root cause is the backend’s redirect logic allowing ar...