{"id":"CVE-2018-18247","aliases":["DEBIAN-CVE-2018-18247","EUVD-2018-9983","GHSA-rgg3-7933-rh7j","UBUNTU-CVE-2018-18247","openSUSE-SU-2020:0067-1","openSUSE-SU-2024:10857-1"],"status":"published","title":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00578,"percentile":0.47888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-12-17T15:00:00Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Debian:12","package":"icingaweb2","fixed_in":["2.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"icingaweb2","fixed_in":["2.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"icingaweb2","fixed_in":["2.6.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1ubuntu1","2.1.0-1ubuntu1.1","2.1.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-1","2.4.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-2","2.9.3-1","2.9.4-1","2.9.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.4-3","2.12.0-1","2.12.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.2-1","2.12.4-1","2.12.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.6-1","2.13.0-1","2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.4-2","2.12.5-1","2.12.6-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3-bp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"icingaweb2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3-bp151.5.3.1"}]}],"bundled":5}],"products":[{"vendor":"icinga","product":"icinga_web_2"}],"references":[{"url":"https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180029.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18247"},{"url":"https://github.com/advisories/GHSA-rgg3-7933-rh7j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18247","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-18247","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18247","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1101357","tags":["report"]},{"url":"https://bugzilla.suse.com/1119784","tags":["report"]},{"url":"https://bugzilla.suse.com/1119785","tags":["report"]},{"url":"https://bugzilla.suse.com/1119799","tags":["report"]},{"url":"https://bugzilla.suse.com/1119800","tags":["report"]},{"url":"https://bugzilla.suse.com/1119801","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18250","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24368","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-18247","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2018-12-17T15:00:00Z","modified":"2024-08-05T11:01:15.084Z","updated_at":"2026-11-02T14:35:11.799349Z"}],"euvd":[{"id":"EUVD-2018-9983","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2018-12-17T15:00:00Z","modified":"2024-08-05T11:01:15Z","updated_at":"2026-11-03T02:39:36.74767Z"}],"ghsa":[{"id":"GHSA-rgg3-7933-rh7j","title":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2022-05-13T01:28:54Z","modified":"2023-02-01T05:08:05Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:40.636216Z"}],"nvd":[{"id":"CVE-2018-18247","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2018-12-17T15:29:00.437Z","modified":"2026-06-17T01:46:53.197Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-18247","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2018-12-17T15:29:00.437Z","modified":"2026-10-24T10:30:27.934118973Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18247","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2018-12-17T15:29:00.437Z","modified":"2026-10-23T18:03:55.764044319Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-18247","description":"Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.","status":"published","published":"2018-12-17T15:29:00Z","modified":"2026-10-17T12:55:10.070539229Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"openSUSE-SU-2020:0067-1","title":"Security update for icingaweb2","description":"This update for icingaweb2 to version 2.7.3 fixes the following issues:\n\nicingaweb2 update to 2.7.3:\n\n* Fixed an issue where servicegroups for roles with filtered objects \n  were not available \n\nicingaweb2 update to 2.7.2:\n\n* Performance imrovements and bug fixes\n\nicingaweb2 update to 2.7.1:\n\n* Highlight links in the notes of an object \n* Fixed an issue where sort rules were no longer working\n* Fixed an issue where statistics were shown with an anarchist way\n* Fixed an issue where wildcards could no show results \n\nicingaweb2 update to 2.7.0:\n\n* New languages support\n* Now module developers got additional ways to customize Icinga Web 2\n* UI enhancements \n\nicingaweb2 update to 2.6.3:\n\n* Fixed various issues with LDAP\n* Fixed issues with timezone\n* UI enhancements \n* Stability fixes\n\nicingaweb2 update to 2.6.2:\n\nYou can find issues and features related to this release on our Roadmap.\nThis bugfix release addresses the following topics:\n\n* Database connections to MySQL 8 no longer fail\n* LDAP connections now have a timeout configuration which defaults to 5 seconds\n* User groups are now correctly loaded for externally authenticated users\n* Filters are respected for all links in the host and service group overviews\n* Fixed permission problems where host and service actions provided by modules were missing\n* Fixed an SQL error in the contact list view when filtering for host groups\n* Fixed time zone (DST) detection\n* Fixed the contact details view if restrictions are active\n* Doc parser and documentation fixes\n\nFix security issues:\n\n- CVE-2018-18246: fixed an CSRF in moduledisable (boo#1119784)\n- CVE-2018-18247: fixed an XSS via /icingaweb2/navigation/add (boo#1119785)\n- CVE-2018-18248: fixed an XSS attack is possible via query strings or a dir parameter (boo#1119801)\n- CVE-2018-18249: fixed an injection of PHP ini-file directives involves environment variables as channel to send out information (boo#1119799)\n- CVE-2018-18250: fixed parameters that can break navigation dashlets (boo#1119800)\n\n- Remove setuid from new upstream spec file for following dirs: \n\n  /etc/icingaweb2,\n  /etc/icingaweb/modules,\n  /etc/icingaweb2/modules/setup,\n  /etc/icingaweb2/modules/translation,\n  /var/log/icingaweb2\n\nicingaweb2 updated to 2.6.1:\n\n- You can find issues and features related to this release on our \n  [Roadmap](https://github.com/Icinga/icingaweb2/milestone/51?closed=1).\n- The command audit now logs a command's payload as JSON which fixes \n  a [bug](https://github.com/Icinga/icingaweb2/issues/3535) \n  that has been introduced in version 2.6.0.\n\nicingaweb2 was updated to 2.6.0:\n\n- You can find issues and features related to this release on our Roadmap.\n\n  * Enabling you to do stuff you couldn't before\n    - Support for PHP 7.2 added\n    - Support for SQLite resources added\n    - Login and Command (monitoring) auditing added with the help of a dedicated module\n    - Pluginoutput rendering is now hookable by modules which allows to render custom icons, emojis and .. cute kitties :octocat:\n  * Avoiding that you miss something\n    - It's now possible to toggle between list- and grid-mode for the host- and servicegroup overviews\n    - The servicegrid now supports to flip its axes which allows it to be put into a landscape mode\n    - Contacts only associated with services are visible now when restricted based on host filters\n    - Negated and combined membership filters now work as expected (#2934)\n    - A more prominent error message in case the monitoring backend goes down\n    - The filter editor doesn't get cleared anymore upon hitting Enter\n  * Making your life a bit easier\n    - The tactical overview is now filterable and can be safely put into the dashboard\n    - It is now possible to register new announcements over the REST Api\n    - Filtering for custom variables now works in UTF8 environments\n  * Ensuring you understand everything\n    - The monitoring health is now beautiful to look at and properly behaves in narrow environments\n    - Updated German localization\n    - Updated Italian localization\n  * Freeing you from unrealiable things\n    - Removed support for PHP \u003c 5.6\n    - Removed support for persistent database connections\n","status":"published","published":"2020-01-16T15:12:13Z","modified":"2026-02-04T04:14:04.675266Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10857-1","title":"icingacli-2.8.4-1.6 on GA media","description":"These are all security issues fixed in the icingacli-2.8.4-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:13.607085Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}