Centreon vulnerabilities

A critical Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module. The message_confirm field is stored unsanitized and rendered via Smarty without security policy, allowing any authenticated user to inject and execute arbitrary code on the server.

Centreon contains an SQL injection vulnerability that allows an authenticated user with access to ACL management to read and modify the Centreon database. The flaw enables manipulation of database data beyond the user's intended permissions.

Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.