CVE-2025-8459CWE-79cross-site-scripting

CVE-2025-8459

High · published October 14, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

⚡ A crafty input method in Centreon Infra Monitoring could let attackers sneak in their own scripts — yes, that's a Stored XSS vulnerability just waiting to be exploited! 🔥 Think of it like a restaurant allowing patrons to submit their own special requests, but not checking what those requests actually are. If a chef isn’t careful, an order could come in that includes a hidden ingredient that should never touch the dish! An attacker could inject malicious scripts into the system, leading to unauthorized data access, session hijacking, or even completely compromising users' accounts. The implications could be absolutely devastating, particularly in environments where sensitive data is involved or where multiple users operate simultaneously.

Put simply

Think of it like a restaurant allowing patrons to submit their own special requests, but not checking what those requests actually are. If a chef isn’t careful, an order could come in that includes a hidden ingredient that should never touch the dish! This XSS vulnerability arises from improper sanitization of user input during web page generation, allowing malicious scripts to be stored and executed when users access affected pages in versions 24.10.0 to 24.10.13, 24.04.0 to 24.04.18, and 23.10.0 to 23.10.28.

What to do

An attacker could inject malicious scripts into the system, leading to unauthorized data access, session hijacking, or even completely compromising users' accounts. The implications could be absolutely devastating, particularly in environments where sensitive data is involved or where multiple users operate simultaneously. To fix this, upgrade to the latest version of Centreon Infra Monitoring that addresses this vulnerability. Ensure proper input validation and sanitization are in place to prevent such attacks in the future. Regularly audit your code for security best practices! You've got this! Follow these steps, and you'll be securing your systems like the security hero you are! 🛡️

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-14T22:15Z
Affected products (3)
ProductVersionsFixed in
centreon/centreon_web≥ 23.10.0, < 23.10.2823.10.28
centreon/centreon_web≥ 24.04.0, < 24.04.1824.04.18
centreon/centreon_web≥ 24.10.0, < 24.10.1324.10.13
References (2)
EPSS history
Timeline
  • 14 OCT 17:11Z
    A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page
    cvelistv5