Medium
icingaweb2 — security advisory
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.
- Products
- icingaweb2
- Affected versions
- 2.11.4-2, 2.11.4-2+deb12u1, 2.11.4-3, 2.12.0-1, 2.12.0-1~exp1, 2.12.1-1, 2.12.2-1, 2.12.4-1, 2.12.4-2, 2.12.5-1, 2.12.5-1~exp1, 2.12.6-1, 2.13.0-1, 2.13.1-1, 2.14.0-1
- Fixed versions
- Not specified
- CVEs
- CVE-2022-50942
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 15:04 UTC · Revision 1
Source evidence
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.
osv:DEBIAN-CVE-2022-50942
icingaweb2
Fixed versions: Not specified
icingaweb2
Fixed versions: Not specified
icingaweb2
Fixed versions: Not specified
Complete source record
{
"id": "603875384f01611c76312cb83105e71baf3a8ea9662c72acfa333385bbb7c623",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-50942",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-50942",
"summary": "Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.",
"evidence": "osv:DEBIAN-CVE-2022-50942",
"products": [
{
"name": {
"value": "icingaweb2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11.4-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.11.4-2+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "2.11.4-3",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.0-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.4-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.4-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.5-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.6-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.13.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.13.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.14.0-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "icingaweb2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.4-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.5-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.5-1~exp1",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.6-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.13.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.13.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.14.0-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "icingaweb2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.4-2",
"evidence": "/affected/2/versions"
},
{
"value": "2.12.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.12.5-1~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "2.12.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.13.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.13.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.14.0-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-50942",
"aliases": [
"DEBIAN-CVE-2022-50942"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icingaweb2",
"purl": "pkg:deb/debian/icingaweb2?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.11.4-2",
"2.11.4-2+deb12u1",
"2.11.4-3",
"2.12.0-1",
"2.12.0-1~exp1",
"2.12.1-1",
"2.12.2-1",
"2.12.4-1",
"2.12.4-2",
"2.12.5-1",
"2.12.5-1~exp1",
"2.12.6-1",
"2.13.0-1",
"2.13.1-1",
"2.14.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50942.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icingaweb2",
"purl": "pkg:deb/debian/icingaweb2?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.12.4-2",
"2.12.5-1",
"2.12.5-1~exp1",
"2.12.6-1",
"2.13.0-1",
"2.13.1-1",
"2.14.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50942.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "icingaweb2",
"purl": "pkg:deb/debian/icingaweb2?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.12.4-2",
"2.12.5-1",
"2.12.5-1~exp1",
"2.12.6-1",
"2.13.0-1",
"2.13.1-1",
"2.14.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50942.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:02:48.299709179Z",
"provider": "osv",
"upstream": [
"CVE-2022-50942"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-50942"
]
},
"related_cves": [
{
"value": "CVE-2022-50942",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 324266,
"published_at": "2026-02-01T13:15:57.44+00:00"
}