CVE-2021-27676
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
Risk Assessment
An attacker can inject malicious scripts that execute in other administrators' browsers, leading to session theft, configuration changes, or data theft.
Recommendation
Immediately upgrade Centreon to version 20.10.3 or later, which fixes this vulnerability.
Other vulnerabilities in Centreon
See all- CVE-2026-14453Critical
A critical Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module. The message_confirm field is stored unsanitized and rendered via Smarty without security policy, allowing any authenticated user to inject and execute arbitrary code on the server.
- CVE-2026-11587High
Centreon contains an SQL injection vulnerability that allows an authenticated user with access to ACL management to read and modify the Centreon database. The flaw enables manipulation of database data beyond the user's intended permissions.
Original NVD description (English source)
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS