Improper access control in Icinga Web 2 - CVE-2021-32747
Published: July 12, 2021 / Updated: July 6, 2026
Vulnerability identifier: #VU136936
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-32747
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the monitoring list routes when processing the undocumented addColumns URL parameter. A remote user can supply crafted addColumns values to disclose sensitive information.
The issue affects access to custom variables on the host and service list routes, including JSON and CSV exports.
Affected software
Icinga Web 2
How to mitigate CVE-2021-32747
Install security update from vendor's website.
Icinga Web 2 - addressed in versions 2.7.5, 2.8.3, 2.9.0