CVE-2025-30164

low-risk

Published 2025-03-26

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.

Do I need to act?

0.08% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.1/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Icinga Web 2

Affected Vendors

Icinga

References (3)

Release Notes https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5

Release Notes https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3

Vendor Advisory https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal