An authenticated cross-site scripting vulnerability in Icinga ipl-web allows remote attackers to execute arbitrary JavaScript in a victim browser session.

This is a Cross-Site Scripting (CWE-79) vulnerability stemming from improper neutralization of input during web page generation. An attacker with high privileges requires user interaction to successfully execute malicious JavaScript within the context of Icinga Web.

A successful exploit could allow an attacker to compromise user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of the victim within the Icinga Web application. While the CVSS score of 7.6 indicates high severity, the requirement for user interaction and administrative privileges slightly mitigates the attack surface, though the potential impact remains total across confidentiality, integrity, and availability.

Immediate Action: Update the Icinga ipl-web component to version 0.13.1 or 0.10.3 immediately.

Proactive Monitoring: Monitor web server and application logs for unusual administrative activity or suspicious parameter inputs involving web components.

Compensating Controls: Implement a strict Content Security Policy (CSP) headers configuration to mitigate the execution of unauthorized inline scripts.

Public Exploit Available: No (false / unknown)

Organizations utilizing the affected Icinga ipl-web package must prioritize applying the provided vendor patches to versions 0.13.1 or 0.10.3. Immediate remediation is crucial to eliminate the risk of session hijacking and unauthorized script execution within administrative interfaces.