Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. Patches Version 0.13.1 includes a fix for this. It will be published as part of icinga-php-library version 0.19.2. Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. References None
Recommended action: Upgrade to 0.13.1 or 0.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF) Affected products: Icinga Web (=2.12.0) Icinga DB Web (=1.0.0) Icinga Notifications Web (=0.1.0) Icinga Web JIRA Integration (=1.3.0) All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Patches Version 0.10.1 will include a fix for this. It will be published as part of the icinga-php-library v0.14.1 release.
Recommended action: Upgrade to 0.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.