CVE-2025-4649: fallo de gravedad media en Centreon web
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.9epss 0.4%
probabilidad de explotación
0.4%top 71% de las CVE
explotación observada
noninguna fuente lo reporta
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.
This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Centreon · webCVEs relacionadas — Centreon web
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-4646HIGHA high privilege user is able to create and use a valid admin API token in centreon-webEPSS 0.4%CVE-2025-4650HIGHUser with high privileges is able to introduce a SQLi using the Meta Service indicator pageEPSS 0.4%CVE-2025-6791HIGHSecond order SQL injection available to user with low privilegeEPSS 0.3%CVE-2025-4647HIGHA user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVGEPSS 0.3%CVE-2025-4648HIGHA user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.EPSS 0.3%