The vulnerability allows an attacker to inject malicious JavaScript into a victim’s browser by exploiting malformed search requests, enabling execution in the context of Icinga Web. The injected code runs with the privileges of the affected web application. A victim needs to visit a specifically prepared website, and the wrongdoing may go unnoticed.

Icinga projects using the ipl-web component version 0.10.2 or earlier, and any 0.13.0 or earlier releases, are affected. The vulnerability is patched in release 0.10.3 and any subsequent releases, as well as in 0.13.1 and later. Deployments running a newer version than those mentioned are not affected.

The CVSS score of 7.6 classifies the issue as high severity. The EPSS score is < 1%, indicating a very low chance of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by sending a crafted HTTP request from a malicious web page to the vulnerable search endpoint, causing the victim’s browser to execute the injected script. The attack requires user interaction (visiting the malicious page) but no authentication.