CVE-2021-32747

What it is

Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and values on configuration objects in Icinga 2. These are commonly used to reference secrets in other configurations such as check commands to be able to authenticate with a service being checked. Icinga Web 2 displays these custom variables to logged in users with access to said hosts or services. In order to protect the secrets from being visible to anyone, it's possible to setup protection rules and blacklists in a user's role. Protection rules result in `***` being shown instead of the original value, the key will remain. Backlists will hide a custom variable entirely from the user. Besides using the UI, custom variables can also be accessed differently by using an undocumented URL parameter. By adding a parameter to the affected routes, Icinga Web 2 will show these columns additionally in the respective list. This parameter is also respected when exporting to JSON or CSV. Protection rules and blacklists however have no effect in this case. Custom variables are shown as-is in the result. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, one may set up a restriction to hide hosts and services with the custom variable in question.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure.

Exploit odds

1.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2021-07-12 23:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 03:53 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 1.4% in the next 30 days (EPSS).
• Severity: 5.3 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2021-07-12 23:15 UTC

Last modified

2026-06-17 03:53 UTC

Exploit probability

1.4% · EPSS, next 30 days

Weakness

CWE-200 · Information exposure

Record status

Modified

Affected

• Icinga < 2.7.5
• Icinga < 2.8.3

Attack profile CVSS 3.1 · 5.3

Attack vector

Network

Complexity

High

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2021-32747.md and follow it. Check whether this project is affected by CVE-2021-32747. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge