Centreon Infra Monitoring Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Centreon Infra Monitoring versions 25.10.0 prior to 25.10.2, 24.10.0 prior to 24.10.15, and 24.04.0 prior to 24.04.19. This vulnerability arises from improper input neutralization during web page generation, specifically within the Administration ACL menu configuration modules. It allows users with high privileges to execute malicious scripts that are stored and potentially executed later.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Centreon Infra Monitoring versions 25.10.2, 24.10.15, or 24.04.19 to address this vulnerability.