CVE-2025-30164

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5	Release Notes
https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3	Release Notes
https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:icinga:icinga_web_2::::::::
	cpe:2.3:a:icinga:icinga_web_2::::::::

History

No history.

Information

Published : 2025-03-26 17:15

Updated : 2025-08-01 15:02

NVD link : CVE-2025-30164

Mitre link : CVE-2025-30164

CVE.ORG link : CVE-2025-30164

JSON object : View

Products Affected

icinga

icinga_web_2

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-30164", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-03-26T17:15:26.560", "references": [{"url": "https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available."}, {"lang": "es", "value": "Icinga Web 2 es una interfaz web, un framework y una interfaz de l\u00ednea de comandos de c\u00f3digo abierto para la monitorizaci\u00f3n. Una vulnerabilidad en versiones anteriores a la 2.11.5 y la 2.12.13 permite a un atacante manipular una URL que, una vez visitada por un usuario autenticado (o capaz de autenticarse), permite manipular el backend para redirigir al usuario a cualquier ubicaci\u00f3n. Este problema se ha resuelto en las versiones 2.11.5 y 2.12.3 de Icinga Web 2. No se conocen workarounds."}], "lastModified": "2025-08-01T15:02:24.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60161BE7-EE17-4A2E-8DE5-754492CB1107", "versionEndExcluding": "2.11.5"}, {"criteria": "cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1137993A-D72D-4EF7-86DC-817F65DEAC3A", "versionEndExcluding": "2.12.3", "versionStartIncluding": "2.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}