CVE-2025-4649: falha de média gravidade em Centreon web
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9epss 0.4%
probabilidade de exploração
0.4%top 71% das CVEs
exploração observada
nãonenhuma fonte reporta
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.
This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Centreon · webCVEs relacionadas — Centreon web
No mesmo produto, das mais perigosas para as menos.
CVE-2025-4646HIGHA high privilege user is able to create and use a valid admin API token in centreon-webEPSS 0.4%CVE-2025-4650HIGHUser with high privileges is able to introduce a SQLi using the Meta Service indicator pageEPSS 0.4%CVE-2025-6791HIGHSecond order SQL injection available to user with low privilegeEPSS 0.3%CVE-2025-4647HIGHA user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVGEPSS 0.3%CVE-2025-4648HIGHA user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.EPSS 0.3%