CVE-2025-8460
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Centreon Infra Monitoring versions 24.10.0 before 24.10.5, 24.04.0 before 24.04.5, and 23.10.0 before 23.10.4 are vulnerable to Stored Cross-Site Scripting in the Notification rules and Open tickets module. The vulnerability is due to improper neutralization of input during web page generation and can be exploited by users with elevated privileges.
Risk Assessment
A user with elevated privileges can inject malicious scripts that execute in other users' browsers, potentially leading to session compromise or unauthorized actions within the monitoring system.
Recommendation
Update Centreon Infra Monitoring to version 24.10.5, 24.04.5, or 23.10.4 (or later) that contain the fix for this vulnerability.
Other vulnerabilities in Centreon Infra Monitoring
See all- CVE-2025-15029Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-15026Critical
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-5965High
In the backup parameters of Centreon Infra Monitoring, a user with high privileges can concatenate custom instructions to the backup setup. Improper neutralization of special elements used in an OS command allows OS Command Injection. This affects versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, and from 24.04.0 before 24.04.19.
- CVE-2025-5946High
OS Command Injection vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules). On the poller parameters page, a user with high privilege can concatenate custom instructions into the poller reload command.
- CVE-2025-54890Medium
Centreon Infra Monitoring (Hostgroup configuration page) is vulnerable to Stored XSS due to improper neutralization of input during web page generation, exploitable by users with elevated privileges.
- CVE-2025-12514High
An SQL Injection vulnerability in the Open-tickets module of Centreon Infra Monitoring allows a user with elevated privileges to inject SQL code. The issue affects versions 24.10.0 through 24.10.4, 24.04.0 through 24.04.4, and 23.10.0 through 23.10.3.
- CVE-2025-10023Medium
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.
- CVE-2025-8459High
Stored XSS vulnerability in Centreon Infra Monitoring (recurrent downtime scheduler modules). Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28 due to improper input neutralization.
- CVE-2025-8430Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
- CVE-2025-8429Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS