UBUNTU-CVE-2025-27406

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-27406
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27406.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-27406
Related
Published
2025-03-26T16:15:00Z
Modified
2025-04-23T15:02:40Z
Summary
[none]
Details

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.

References

Affected packages

Ubuntu:22.04:LTS / icingaweb2-module-reporting

Package

Name
icingaweb2-module-reporting
Purl
pkg:deb/ubuntu/icingaweb2-module-reporting@0.9.2+20200529-2?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.9.2+20200529-1
0.9.2+20200529-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / icingaweb2-module-reporting

Package

Name
icingaweb2-module-reporting
Purl
pkg:deb/ubuntu/icingaweb2-module-reporting@1.0.2-1?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.0-2

1.*

1.0.1-1
1.0.2-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / icingaweb2-module-reporting

Package

Name
icingaweb2-module-reporting
Purl
pkg:deb/ubuntu/icingaweb2-module-reporting@0.10.0-2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.0-1
0.10.0-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:25.04 / icingaweb2-module-reporting

Package

Name
icingaweb2-module-reporting
Purl
pkg:deb/ubuntu/icingaweb2-module-reporting@1.0.2-2?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.2-1
1.0.2-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}