CVE-2020-10946
Estado: ModificadaMedia (6.1)—
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.23%
- Percentil entre todas las CVEs puntuadas: 82
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-10946",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2020-05-27T16:15:12.717",
"references": [
{
"url": "https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS), permite a atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro page en el archivo service-monitoring/src/index.php. Esta vulnerabilidad es corregida en las versiones 1.6.4, 18.10.3, 19.04.3 y 19.0.1 del Centreon host-monitoring widget; las versiones 1.6.4, 18.10.5, 19.04.3, 19.10.2 del Centreon service-monitoring widget; y las versiones 1.0.3, 18.10.1, 19.04.1, 19.10.1 del Centreon tactical-overview widget."
}
],
"lastModified": "2026-06-17T02:48:43.847",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:centreon:centreon_host-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11CDDB5F-0CE5-4096-87A4-F7FD7037B8AC",
"versionEndExcluding": "1.6.4"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_host-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD6C9263-8455-4460-9256-8E3024B22ACF",
"versionEndExcluding": "18.10.3",
"versionStartIncluding": "18.10.0"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_host-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2008D772-6518-4F3F-90F5-AD0DCA60D165",
"versionEndExcluding": "19.0.1",
"versionStartIncluding": "19.0.0"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_host-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4FC23D4-13D9-495A-8C0E-361792AD30EF",
"versionEndExcluding": "19.04.3",
"versionStartIncluding": "19.04.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:centreon:centreon_tactical-overview_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C768C6C6-45AC-403A-9A38-F11A18080F40",
"versionEndExcluding": "1.0.3"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_tactical-overview_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74B069A6-1F9A-4CE6-8F86-F0D020B31A58",
"versionEndExcluding": "18.10.1",
"versionStartIncluding": "18.10.0"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_tactical-overview_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC7CF011-6871-4452-A07F-C08C2D3D629F",
"versionEndExcluding": "19.04.1",
"versionStartIncluding": "19.04.0"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_tactical-overview_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "335A0BD6-014E-4CE8-A9EE-4328C2C1AE18",
"versionEndExcluding": "19.10.1",
"versionStartIncluding": "19.10.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:centreon:centreon_service-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46C2C055-430F-4913-B650-8C0233D99F42",
"versionEndExcluding": "1.6.4"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_service-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4582BF2-2BEF-4E32-B537-2898859AAFF2",
"versionEndExcluding": "18.10.5",
"versionStartIncluding": "18.10.0"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_service-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8903042C-5B5B-4CAF-94E2-BFA5F0CE5EC1",
"versionEndExcluding": "19.04.3",
"versionStartIncluding": "19.04.0"
},
{
"criteria": "cpe:2.3:a:centreon:centreon_service-monitoring_widget:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50369D54-898A-4FB3-8246-E8BD3BA8A913",
"versionEndExcluding": "19.10.2",
"versionStartIncluding": "19.10.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}