The vulnerability allows an attacker to inject and have the server reflect malicious JavaScript in a victim’s browser when a specially crafted search request is processed. This results in code that runs with the privileges of the affected web application, potentially allowing data theft, session hijacking or further network compromise.

Icinga projects using the ipl-web component prior to version 0.13.1 are affected. The vulnerability applies to all deployments of Icinga ipl-web that have not been updated to v0.13.1 or later.

The CVSS score of 7.6 classifies the issue as high severity. No EPSS score is available, and the vulnerability has not been reported in CISA’s KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request to the search endpoint from a malicious web page that then causes the victim’s browser to execute the injected script. The attack requires that a user visits a page that triggers the vulnerable endpoint; no authentication is required.