CVE-2025-61789— Icinga DB Web hidden/protected custom variables are prone to filter enumeration
Quick assessment
Affected
Icinga icingadb-web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Icinga DB Web是Icinga开源的一个Icinga DB数据库的图形界面。 Icinga DB Web 1.1.4之前版本和1.2.3之前版本存在安全漏洞，该漏洞源于授权用户可通过自定义变量猜测受保护或隐藏变量的值。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-61789
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Icinga DB Web hidden/protected custom variables are prone to filter enumeration
Source: CVE Program / CVE List V5
Vulnerability Description
Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
响应差异性信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Icinga DB Web 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Icinga DB Web是Icinga开源的一个Icinga DB数据库的图形界面。 Icinga DB Web 1.1.4之前版本和1.2.3之前版本存在安全漏洞，该漏洞源于授权用户可通过自定义变量猜测受保护或隐藏变量的值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Icinga | icingadb-web | < 1.1.4 | - |
|
II. Public POCs for CVE-2025-61789
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-61789
请登录查看更多情报信息。
Same Patch Batch · Icinga · 2025-10-16 · 4 CVEs total
| CVE-2025-61907 | Icinga 2 API users could access restricted values in filter expressions | |
| CVE-2025-61908 | Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference | |
| CVE-2025-61909 | Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemo |
IV. Related Vulnerabilities
Same vendor: Icinga
-
CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search r -
CVE-2026-24414
Icinga for Windows certificate can have too-open permissions -
CVE-2026-24413
Icinga has insecure permission of %ProgramData%\icinga2\var -
CVE-2025-61909
Icinga 2 signals sent as root to processes based on PID file -
CVE-2025-61908
Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Re
Same weakness: CWE-204
-
CVE-2026-81033
Automatisch through 0.15.0 User Enumeration via Forgot-Passw -
CVE-2026-27462
Combodo iTop: User enumeration via password reset -
CVE-2026-69519
Azure Stack HCI Information Disclosure Vulnerability -
CVE-2026-66002
Frappe: User Enumeration via PDDR -
CVE-2026-54739
Lemmy: Login Endpoint User Enumeration via HTTP Response Cod
V. Comments for CVE-2025-61789
No comments yet