Icinga Web Version 2.12.3
What's New in Version 2.12.3
Notice: This is a security release. It is recommended to upgrade immediately.
You can find all issues related to this release on our Roadmap.
Vulnerabilities, Closed
Cross site scripting is one of the worst attacks on web based platforms. Especially, if carrying it out is as easy as the first two mentioned here. You might recognize the open redirect on the login. You are correct, we attempted to fix it already with v2.11.3 but underestimated PHP's quirks. The last is difficult to exploit, hence the lowest severity of all, but don't be fooled by that!
All four of them are backported to v2.11.5.
- XSS in embedded content CVE-2025-27405