High · published October 14, 2025
⚡ A crafty input method in Centreon Infra Monitoring could let attackers sneak in their own scripts — yes, that's a Stored XSS vulnerability just waiting to be exploited! 🔥 Think of it like a restaurant allowing patrons to submit their own special requests, but not checking what those requests actually are. If a chef isn’t careful, an order could come in that includes a hidden ingredient that should never touch the dish! An attacker could inject malicious scripts into the system, leading to unauthorized data access, session hijacking, or even completely compromising users' accounts. The implications could be absolutely devastating, particularly in environments where sensitive data is involved or where multiple users operate simultaneously.
Think of it like a restaurant allowing patrons to submit their own special requests, but not checking what those requests actually are. If a chef isn’t careful, an order could come in that includes a hidden ingredient that should never touch the dish! This XSS vulnerability arises from improper sanitization of user input during web page generation, allowing malicious scripts to be stored and executed when users access affected pages in versions 24.10.0 to 24.10.13, 24.04.0 to 24.04.18, and 23.10.0 to 23.10.28.
An attacker could inject malicious scripts into the system, leading to unauthorized data access, session hijacking, or even completely compromising users' accounts. The implications could be absolutely devastating, particularly in environments where sensitive data is involved or where multiple users operate simultaneously. To fix this, upgrade to the latest version of Centreon Infra Monitoring that addresses this vulnerability. Ensure proper input validation and sanitization are in place to prevent such attacks in the future. Regularly audit your code for security best practices! You've got this! Follow these steps, and you'll be securing your systems like the security hero you are! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| centreon/centreon_web | ≥ 23.10.0, < 23.10.28 | 23.10.28 |
| centreon/centreon_web | ≥ 24.04.0, < 24.04.18 | 24.04.18 |
| centreon/centreon_web | ≥ 24.10.0, < 24.10.13 | 24.10.13 |