{"id":"CVE-2025-61789","aliases":["DEBIAN-CVE-2025-61789","EUVD-2025-34795","GHSA-w57j-28jc-8429","UBUNTU-CVE-2025-61789"],"status":"published","title":"Icinga DB Web hidden/protected custom variables are prone to filter enumeration","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00371,"percentile":0.31445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-204"],"published":"2025-10-16T17:00:32Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Debian:14","package":"icingadb-web","fixed_in":["1.2.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"icingadb-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-1","1.1.0-1","1.1.0-1~exp1","1.1.1-1","1.1.2-1","1.1.3-1","1.2.0-1~exp1","1.2.1-1~exp1","1.2.2-1","1.2.2-1~exp1","1.2.3-1","1.3.0-1","1.4.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"icingadb-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-1","1.2.0-1~exp1","1.2.1-1~exp1","1.2.2-1","1.2.2-1~exp1","1.2.3-1","1.3.0-1","1.4.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"icingadb-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}],"versions":["1.1.3-1","1.2.0-1~exp1","1.2.1-1~exp1","1.2.2-1","1.2.2-1~exp1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"icingadb-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-1","1.1.0-1","1.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"icingadb-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"icingadb-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-1","1.2.3-1","1.3.0-1"]}],"products":[{"vendor":"icinga","product":"icinga_db_web"},{"vendor":"icinga","product":"icingadb-web"}],"references":[{"url":"https://github.com/Icinga/icingadb-web/security/advisories/GHSA-w57j-28jc-8429","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/Icinga/icingadb-web/commit/5e982dad40ec379075307ab1693580138e675b18","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61789.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61789","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-61789","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-61789","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61789","tags":["report"]},{"url":"https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-61789","title":"Icinga DB Web hidden/protected custom variables are prone to filter enumeration","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","status":"published","published":"2025-10-16T17:00:32.247Z","modified":"2025-10-16T18:03:11.988Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-34795","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","status":"published","published":"2025-10-16T17:00:32Z","modified":"2025-10-16T18:03:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:31.065489Z"}],"nvd":[{"id":"CVE-2025-61789","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","status":"published","published":"2025-10-16T17:15:34.59Z","modified":"2026-10-09T10:10:00.193Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-61789","title":"Icinga DB Web hidden/protected custom variables are prone to filter enumeration","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","status":"published","published":"2025-10-16T17:00:32.247Z","modified":"2026-10-28T02:30:46.665424417Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-61789","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","status":"published","published":"2025-10-16T17:15:34.59Z","modified":"2026-10-10T09:47:37.487435818Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-61789","description":"Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.","status":"published","published":"2025-10-16T17:15:00Z","modified":"2026-05-20T16:23:39.114356945Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"}]}}