HIGH🇵🇱 Wersja polska

CVE-2025-61907

CVSS 7.1v4.0pub. 2025-10-16upd. 2025-11-26

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Icinga

    APP
    Icinga
    2.15.02.4.0 – 2.13.13 (excl.)2.14.0 – 2.14.7 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-48057CRITICAL9.3PL ✓same product

Icinga 2: obejście weryfikacji certyfikatu umożliwia podszywanie się pod węzły

CVE-2024-49369CRITICAL9.8PL ✓same product

Icinga 2: błędna walidacja certyfikatów TLS umożliwia podszywanie się pod węzły klastra i użytkowników API

CVE-2020-29663CRITICAL9.1PL ✓same product

Icinga 2 — automatyczne odnawianie unieważnionych certyfikatów (pominięcie CRL)

CVE-2025-61908HIGH7.1same product

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating...

CVE-2024-24820HIGH8.3same product

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's ...