CVE-2025-61907

HIGH EPSS 28.4%
Published Oct 16, 20258mo ago · Modified Jun 17, 20261w ago
7.1 CVSS 4.0
High
Find Similar
Published Oct 16, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago

Description

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.

CVSS Details

Base Score
7.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
28.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 3

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-204
CWE-749

Affected Products 3

VendorProductVersionRange
icingaicinga*≥2.4.0  –  <2.13.13
icingaicinga*≥2.14.0  –  <2.14.7
icingaicinga2.15.0any

References 2

  • github.com https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3
    Patch
  • github.com https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v
    PatchVendor Advisory

Remediation

  • github.com https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3
    Patch
  • github.com https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v
    PatchVendor Advisory