Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-27609
CVE-2025-27609:
Linux Debian vulnerability analysis and mitigation
Overview
Icinga Web 2, an open source monitoring web interface, framework and command-line interface, was found to contain a cross-site scripting vulnerability (CVE-2025-27609). The vulnerability affects versions prior to 2.11.5 and 2.12.13, allowing attackers to craft requests that can embed arbitrary JavaScript code into a victim's Icinga Web instance (GitHub Advisory). The issue was discovered and reported by moezbouzayani9, and was officially disclosed on March 26, 2025 (NVD).
Technical details
The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v4.0 score is rated as LOW with a base vector of CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U (NVD).
Impact
When successfully exploited, the vulnerability enables attackers to embed arbitrary JavaScript code into the victim's Icinga Web instance, allowing them to act on behalf of the affected user (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in Icinga Web 2 versions 2.11.5 and 2.12.3. For users running version 2.12.2 who cannot immediately update, enabling Content Security Policy (CSP) in the application settings serves as a temporary workaround. Additionally, modern browsers with functioning CORS implementations provide sufficient protection against this vulnerability (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management