CVE-2025-61907
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-11-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| icinga | icinga | From 2.4.0 (inc) to 2.13.13 (exc) |
| icinga | icinga | From 2.14.0 (inc) to 2.14.7 (exc) |
| icinga | icinga | 2.15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-749 | The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Icinga 2 versions 2.4 through 2.15.0 allows authenticated API users to use filter expressions on the /v1/objects endpoints to access variables or objects that should normally be inaccessible to them. This means users can retrieve sensitive information, such as global variables and objects, that they do not have permission to see. The issue is fixed in versions 2.15.1, 2.14.7, and 2.13.13.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information within the Icinga 2 monitoring system. Authenticated users with limited permissions could gain access to restricted data, potentially exposing confidential configuration details or system information that should remain hidden, which could be leveraged for further attacks or misuse.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Icinga 2 to version 2.15.1, 2.14.7, or 2.13.13 or later, as these versions contain the fix for the issue.