Open Redirect in Icinga Web 2
CVE-2025-30164
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
Vulnerability class: Open Redirect
EPSS: 0.003 (17.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N.
Affected products
- Icinga Icinga_web_2
- Icinga Icingaweb2 — versions < 2.11.5, >= 2.12.0, < 2.12.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2025-30164?
- CVE-2025-30164 is a medium-severity vulnerability in Icinga Web 2, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.1/10. Published 2025-03-26.
- How severe is CVE-2025-30164?
- Medium severity. CVSS v3 base score is 4.1 out of 10.
- Is CVE-2025-30164 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.