Centreon Web Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in Centreon Web versions 24.10.3 prior to 24.10.4, 24.04.09 prior to 24.04.10, 23.10.19 prior to 23.10.21, and 23.04.24 prior to 23.04.26. This vulnerability arises from improper management of access control lists (ACLs), which are not correctly applied on the 'event logs' page. This page, requiring high privileges, inadvertently exposes all available logs to users who should not have access.

Impact

Exploitation of this vulnerability allows users to gain unauthorized access to event logs, potentially leading to exposure of sensitive information or misuse of logged data.

Remediation

Users are advised to update to Centreon Web versions 24.10.4, 24.04.10, 23.10.21, or 23.04.26, all of which include cumulative fixes from prior updates.