Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-61907

Good to know:

icon

Date: October 16, 2025

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.

Severity Score

Related Resources (4)

https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3
https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v
https://nvd.nist.gov/vuln/detail/CVE-2025-61907
https://www.mend.io/vulnerability-database/CVE-2025-61907

Severity Score

Weakness Type (CWE)

Exposed Dangerous Method or Function

CWE-749

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Observable Response Discrepancy

CWE-204

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/Icinga/icinga2.git - v2.13.13;https://github.com/Icinga/icinga2.git - v2.14.7;https://github.com/Icinga/icinga2.git - v2.15.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us