We fixed two security vulnerabilities related to the web interface. They were related to the cross-site request forgery attack and the clickjacking attack. Both are used to induce users to perform actions that they do not intend to perform by hiding the NetEye web interface under some eye-catching pages or with some malicious links sent for example by email.
More information on how the vulnerabilities work can be found here:
Furthermore, we fixed a bug related to the users SSO in the ITOA module. When the users belonged to teams of different organizations, the teams were not correctly assigned.
For NetEye 4.17 we updated the following packages:
httpd-neteye-config and httpd-neteye-config-autosetup to version 1.9.1-1
icingaweb2-module-analytics and icingaweb2-module-analytics-autosetup to version 1.38.1-1
Mattia Codato
Software Developer - IT System & Service Management Solutions at Würth IT Italy
Author
Mattia Codato
Software Developer - IT System & Service Management Solutions at Würth IT Italy
Resolved issue affecting neteye update We identified and fixed a bug that could cause the neteye update command to fail under specific circumstances. List of updated packages To solve the issue mentioned above, the following packages have been updated for Read More
Important: Icinga 2 security update Type/Severity NetEye Product Security has rated this update as having a critical security impact. Topic An update for the icinga package is now available for NetEye 4. Security Fix for NetEye 4.46 2.15.5_neteye1.64.3-1 Summary The vulnerabilities include an Read More
Important: Icinga 2 security update Type/Severity NetEye Product Security has rated this update as having a critical security impact. Topic An update for the icinga package is now available for NetEye 4. Security Fix for NetEye 4.47 2.15.5_neteye1.68.3-1 Summary The vulnerabilities include an Read More
Important: NagVis security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the nagvis and icingaweb2-module-nagvis packages is now available for NetEye 4. Security Fix for NetEye 4.48 nagvis-1.9.49_neteye1.8.2-1 icingaweb2-module-nagvis-1.1.1_neteye1.10.1-1 Summary The vulnerabilities Read More
Important: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.48 9.4.4_neteye3.101.4-1 CVEs Elasticsearch CVE-2026-63263CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-63144CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-63140CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Read More
