Icinga Web 2 Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Icinga Web 2 versions prior to 2.11.5 and 2.12.2. This vulnerability allows an attacker to send a crafted request that embeds arbitrary JavaScript, which is then executed in the context of the user receiving the request. The issue has been addressed in versions 2.11.5 and 2.12.3.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious JavaScript in the context of the victim's browser session.

Remediation

Users can upgrade to Icinga Web 2.11.5 or 2.12.3 to address this vulnerability. For those on version 2.12.2, enabling a content security policy in the application settings can serve as a temporary workaround. Additionally, any modern browser with a functional CORS implementation provides adequate protection against this vulnerability.