<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for icingaweb2</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2020:0067-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-01-16T15:12:13Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-01-16T15:12:13Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-01-16T15:12:13Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for icingaweb2</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for icingaweb2 to version 2.7.3 fixes the following issues:

icingaweb2 update to 2.7.3:

* Fixed an issue where servicegroups for roles with filtered objects 
  were not available 

icingaweb2 update to 2.7.2:

* Performance imrovements and bug fixes

icingaweb2 update to 2.7.1:

* Highlight links in the notes of an object 
* Fixed an issue where sort rules were no longer working
* Fixed an issue where statistics were shown with an anarchist way
* Fixed an issue where wildcards could no show results 

icingaweb2 update to 2.7.0:

* New languages support
* Now module developers got additional ways to customize Icinga Web 2
* UI enhancements 

icingaweb2 update to 2.6.3:

* Fixed various issues with LDAP
* Fixed issues with timezone
* UI enhancements 
* Stability fixes

icingaweb2 update to 2.6.2:

You can find issues and features related to this release on our Roadmap.
This bugfix release addresses the following topics:

* Database connections to MySQL 8 no longer fail
* LDAP connections now have a timeout configuration which defaults to 5 seconds
* User groups are now correctly loaded for externally authenticated users
* Filters are respected for all links in the host and service group overviews
* Fixed permission problems where host and service actions provided by modules were missing
* Fixed an SQL error in the contact list view when filtering for host groups
* Fixed time zone (DST) detection
* Fixed the contact details view if restrictions are active
* Doc parser and documentation fixes

Fix security issues:

- CVE-2018-18246: fixed an CSRF in moduledisable (boo#1119784)
- CVE-2018-18247: fixed an XSS via /icingaweb2/navigation/add (boo#1119785)
- CVE-2018-18248: fixed an XSS attack is possible via query strings or a dir parameter (boo#1119801)
- CVE-2018-18249: fixed an injection of PHP ini-file directives involves environment variables as channel to send out information (boo#1119799)
- CVE-2018-18250: fixed parameters that can break navigation dashlets (boo#1119800)

- Remove setuid from new upstream spec file for following dirs: 

  /etc/icingaweb2,
  /etc/icingaweb/modules,
  /etc/icingaweb2/modules/setup,
  /etc/icingaweb2/modules/translation,
  /var/log/icingaweb2

icingaweb2 updated to 2.6.1:

- You can find issues and features related to this release on our 
  [Roadmap](https://github.com/Icinga/icingaweb2/milestone/51?closed=1).
- The command audit now logs a command's payload as JSON which fixes 
  a [bug](https://github.com/Icinga/icingaweb2/issues/3535) 
  that has been introduced in version 2.6.0.

icingaweb2 was updated to 2.6.0:

- You can find issues and features related to this release on our Roadmap.

  * Enabling you to do stuff you couldn't before
    - Support for PHP 7.2 added
    - Support for SQLite resources added
    - Login and Command (monitoring) auditing added with the help of a dedicated module
    - Pluginoutput rendering is now hookable by modules which allows to render custom icons, emojis and .. cute kitties :octocat:
  * Avoiding that you miss something
    - It's now possible to toggle between list- and grid-mode for the host- and servicegroup overviews
    - The servicegrid now supports to flip its axes which allows it to be put into a landscape mode
    - Contacts only associated with services are visible now when restricted based on host filters
    - Negated and combined membership filters now work as expected (#2934)
    - A more prominent error message in case the monitoring backend goes down
    - The filter editor doesn't get cleared anymore upon hitting Enter
  * Making your life a bit easier
    - The tactical overview is now filterable and can be safely put into the dashboard
    - It is now possible to register new announcements over the REST Api
    - Filtering for custom variables now works in UTF8 environments
  * Ensuring you understand everything
    - The monitoring health is now beautiful to look at and properly behaves in narrow environments
    - Updated German localization
    - Updated Italian localization
  * Freeing you from unrealiable things
    - Removed support for PHP &lt; 5.6
    - Removed support for persistent database connections
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2020-67</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/</URL>
      <Description>E-Mail link for openSUSE-SU-2020:0067-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1101357</URL>
      <Description>SUSE Bug 1101357</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119784</URL>
      <Description>SUSE Bug 1119784</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119785</URL>
      <Description>SUSE Bug 1119785</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119799</URL>
      <Description>SUSE Bug 1119799</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119800</URL>
      <Description>SUSE Bug 1119800</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119801</URL>
      <Description>SUSE Bug 1119801</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-18246/</URL>
      <Description>SUSE CVE CVE-2018-18246 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-18247/</URL>
      <Description>SUSE CVE CVE-2018-18247 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-18248/</URL>
      <Description>SUSE CVE CVE-2018-18248 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-18249/</URL>
      <Description>SUSE CVE CVE-2018-18249 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-18250/</URL>
      <Description>SUSE CVE CVE-2018-18250 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 12">
      <Branch Type="Product Name" Name="SUSE Package Hub 12">
        <FullProductName ProductID="SUSE Package Hub 12" CPE="cpe:/o:suse:packagehub:12">SUSE Package Hub 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Package Hub 15">
      <Branch Type="Product Name" Name="SUSE Package Hub 15">
        <FullProductName ProductID="SUSE Package Hub 15">SUSE Package Hub 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Package Hub 15 SP1">
      <Branch Type="Product Name" Name="SUSE Package Hub 15 SP1">
        <FullProductName ProductID="SUSE Package Hub 15 SP1">SUSE Package Hub 15 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.0">
      <Branch Type="Product Name" Name="openSUSE Leap 15.0">
        <FullProductName ProductID="openSUSE Leap 15.0" CPE="cpe:/o:opensuse:leap:15.0">openSUSE Leap 15.0</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.1">
      <Branch Type="Product Name" Name="openSUSE Leap 15.1">
        <FullProductName ProductID="openSUSE Leap 15.1" CPE="cpe:/o:opensuse:leap:15.1">openSUSE Leap 15.1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="icingacli-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingacli-2.7.3-bp151.5.3.1">icingacli-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-2.7.3-bp151.5.3.1">icingaweb2-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-common-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-common-2.7.3-bp151.5.3.1">icingaweb2-common-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="php-Icinga-2.7.3-bp151.5.3.1">
      <FullProductName ProductID="php-Icinga-2.7.3-bp151.5.3.1">php-Icinga-2.7.3-bp151.5.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="icingacli-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingacli-2.7.3-bp151.5.3.1">icingacli-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-2.7.3-bp151.5.3.1">icingaweb2-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-common-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-common-2.7.3-bp151.5.3.1">icingaweb2-common-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="php-Icinga-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 12">
      <FullProductName ProductID="SUSE Package Hub 12:php-Icinga-2.7.3-bp151.5.3.1">php-Icinga-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingacli-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingacli-2.7.3-bp151.5.3.1">icingacli-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-2.7.3-bp151.5.3.1">icingaweb2-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-common-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-common-2.7.3-bp151.5.3.1">icingaweb2-common-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="php-Icinga-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:php-Icinga-2.7.3-bp151.5.3.1">php-Icinga-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingacli-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingacli-2.7.3-bp151.5.3.1">icingacli-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-2.7.3-bp151.5.3.1">icingaweb2-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-common-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-common-2.7.3-bp151.5.3.1">icingaweb2-common-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="php-Icinga-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP1">
      <FullProductName ProductID="SUSE Package Hub 15 SP1:php-Icinga-2.7.3-bp151.5.3.1">php-Icinga-2.7.3-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingacli-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingacli-2.7.3-bp151.5.3.1">icingacli-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-2.7.3-bp151.5.3.1">icingaweb2-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-common-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-common-2.7.3-bp151.5.3.1">icingaweb2-common-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="php-Icinga-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.0">
      <FullProductName ProductID="openSUSE Leap 15.0:php-Icinga-2.7.3-bp151.5.3.1">php-Icinga-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingacli-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingacli-2.7.3-bp151.5.3.1">icingacli-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-2.7.3-bp151.5.3.1">icingaweb2-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-common-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-common-2.7.3-bp151.5.3.1">icingaweb2-common-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1">icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1">icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1">icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1">icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1">icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1">icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="php-Icinga-2.7.3-bp151.5.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.1">
      <FullProductName ProductID="openSUSE Leap 15.1:php-Icinga-2.7.3-bp151.5.3.1">php-Icinga-2.7.3-bp151.5.3.1 as a component of openSUSE Leap 15.1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.</Note>
    </Notes>
    <CVE>CVE-2018-18246</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-18246.html</URL>
        <Description>CVE-2018-18246</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1119784</URL>
        <Description>SUSE Bug 1119784</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.</Note>
    </Notes>
    <CVE>CVE-2018-18247</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.5</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.4</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-18247.html</URL>
        <Description>CVE-2018-18247</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1119785</URL>
        <Description>SUSE Bug 1119785</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string.</Note>
    </Notes>
    <CVE>CVE-2018-18248</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-18248.html</URL>
        <Description>CVE-2018-18248</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1119801</URL>
        <Description>SUSE Bug 1119801</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.</Note>
    </Notes>
    <CVE>CVE-2018-18249</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-18249.html</URL>
        <Description>CVE-2018-18249</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1119799</URL>
        <Description>SUSE Bug 1119799</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item.</Note>
    </Notes>
    <CVE>CVE-2018-18250</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 12:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 12:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15 SP1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>SUSE Package Hub 15:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.0:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingacli-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-common-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-HTMLPurifier-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-JShrink-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-Parsedown-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-dompdf-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-lessphp-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:icingaweb2-vendor-zf1-2.7.3-bp151.5.3.1</ProductID>
        <ProductID>openSUSE Leap 15.1:php-Icinga-2.7.3-bp151.5.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYR3CRPR6ULC3DIQMEBEOTBJQVA76WI/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-18250.html</URL>
        <Description>CVE-2018-18250</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1119800</URL>
        <Description>SUSE Bug 1119800</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
