p PatchFirst

CVE-2022-50942

CVE-2022-50942 · Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.

CVSS 4.8 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • incinga web

    Versions
    • 2.8.2: Affected

    No fix published

  • icingaweb2 Debian:12

    Versions
    • 2.11.4-2
    • 2.11.4-2+deb12u1
    • 2.11.4-3
    • 2.12.0-1
    • 2.12.0-1~exp1
    • 2.12.1-1
    • 2.12.2-1
    • 2.12.4-1
    • 2.12.4-2
    • 2.12.5-1
    • 2.12.5-1~exp1
    • 2.12.6-1
    • 2.13.0-1
    • 2.13.1-1
    • 2.14.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Debian:13

    Versions
    • 2.12.4-2
    • 2.12.5-1
    • 2.12.5-1~exp1
    • 2.12.6-1
    • 2.13.0-1
    • 2.13.1-1
    • 2.14.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Debian:14

    Versions
    • 2.12.4-2
    • 2.12.5-1
    • 2.12.5-1~exp1
    • 2.12.6-1
    • 2.13.0-1
    • 2.13.1-1
    • 2.14.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:16.04:LTS

    Versions
    • 2.1.0-1ubuntu1
    • 2.1.0-1ubuntu1.1
    • 2.1.0-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:18.04:LTS

    Versions
    • 2.4.1-1
    • 2.4.1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:20.04:LTS

    Versions
    • 2.7.1-1
    • 2.7.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:22.04:LTS

    Versions
    • 2.8.2-2
    • 2.9.3-1
    • 2.9.4-1
    • 2.9.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:24.04:LTS

    Versions
    • 2.11.4-3
    • 2.12.0-1
    • 2.12.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:25.10

    Versions
    • 2.12.2-1
    • 2.12.4-1
    • 2.12.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:26.10

    Versions
    • 2.12.6-1
    • 2.13.0-1
    • 2.14.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • icingaweb2 Ubuntu:26.04:LTS

    Versions
    • 2.12.4-2
    • 2.12.5-1
    • 2.12.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →