CVE-2025-4647: fallo de gravedad alta en Centreon web
A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.4epss 0.3%
probabilidad de explotación
0.3%top 80% de las CVE
explotación observada
noninguna fuente lo reporta
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS.
A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG.
This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Productos afectados
Centreon · webCVEs relacionadas — Centreon web
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-4646HIGHA high privilege user is able to create and use a valid admin API token in centreon-webEPSS 0.4%CVE-2025-4650HIGHUser with high privileges is able to introduce a SQLi using the Meta Service indicator pageEPSS 0.4%CVE-2025-4649MEDIUMACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.EPSS 0.4%CVE-2025-6791HIGHSecond order SQL injection available to user with low privilegeEPSS 0.3%CVE-2025-4648HIGHA user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.EPSS 0.3%