CVE-2025-53840

LOW EPSS 17.3%
Published Jul 16, 202511mo ago · Modified Jun 17, 20261w ago
2.4 CVSS 3.1
Low
Find Similar
Published Jul 16, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago

Description

Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.

CVSS Details

Base Score
2.4
Exploitability
0.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
17.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
icingaicinga_db_web*≥1.2.0  –  <1.2.2

References 2

  • github.com https://github.com/Icinga/icingadb-web/releases/tag/v1.2.2
    Release Notes
  • github.com https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473
    PatchVendor Advisory

Remediation

  • github.com https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473
    PatchVendor Advisory