Centreon Infra Monitoring HTTP Loader Widget Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Centreon Infra Monitoring versions 24.10.0 prior to 24.10.13, 24.04.0 prior to 24.04.18, and 23.10.0 prior to 23.10.28. This vulnerability arises from improper input neutralization during web page generation, allowing users with minimal rights to inject JavaScript payloads into custom views. These injected scripts can then spoof the sessions of administrators or supervisors.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users are advised to update Centreon Web on the Central Server to version 24.10.13, 24.04.18, or 23.10.28, all of which include cumulative fixes from prior updates.