Hidden/Protected custom variables are prone to filter enumeration

2025-10-20 · CVE-2025-61789 · VuXML entry

Icinga reports: An authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it.

Affected versions

• icingaweb2-module-icingadb-php81 < 1.1.4; >= 1.2 < 1.2.3,1
• icingaweb2-module-icingadb-php82 < 1.1.4; >= 1.2 < 1.2.3,1
• icingaweb2-module-icingadb-php83 < 1.1.4; >= 1.2 < 1.2.3,1
• icingaweb2-module-icingadb-php84 < 1.1.4; >= 1.2 < 1.2.3,1
• icingaweb2-module-icingadb-php85 < 1.1.4; >= 1.2 < 1.2.3,1

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.