Icinga DB Web Hidden Variable Enumeration Vulnerability

A vulnerability exists in Icinga DB Web versions prior to 1.1.4 and 1.2.3, allowing authorized users to enumerate values of custom variables that are either protected or hidden. This is achieved by using these variables in filters, which can lead to unauthorized information disclosure. The vulnerability arises from inadequate handling of variable visibility in the application's filtering system.

Impact

Exploitation of this vulnerability allows for the unauthorized enumeration of hidden or protected custom variable values, potentially leading to sensitive information disclosure.

Remediation

Users can upgrade to Icinga DB Web versions 1.1.4 or 1.2.3, which address this vulnerability by returning an error when such custom variables are used. No additional workarounds are available.