« Volver al listado

CVE-2025-12511

Estado: AnalizadaMedia (4.8)—

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS

to user with elevated privileges.

This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Centreon — Dynamic Service Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-12511",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-12511",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-05T21:19:22.167506Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "affectedData": [
        {
          "vendor": "Centreon",
          "modules": [
            "DSM extenstio configuration"
          ],
          "product": "Infra Monitoring",
          "versions": [
            {
              "status": "affected",
              "version": "25.10.0",
              "lessThan": "25.10.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.04.0",
              "lessThan": "24.04.8",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-05T14:15:53.133",
  "references": [
    {
      "url": "https://github.com/centreon/centreon/releases",
      "tags": [
        "Release Notes"
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
    },
    {
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-12511-centreon-dsm-medium-severity-5361",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS \n\nto user with elevated privileges.\n\nThis issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8."
    },
    {
      "lang": "es",
      "value": "Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (XSS o 'cross-site scripting') vulnerabilidad en Centreon Infra Monitoring (módulos de configuración de la extensión DSM) permite XSS Almacenado a usuario con privilegios elevados.\n\nEste problema afecta a Infra Monitoring: desde 25.10.0 antes de 25.10.1, desde 24.10.0 antes de 24.10.4, desde 24.04.0 antes de 24.04.8."
    }
  ],
  "lastModified": "2026-06-17T08:32:30.600",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:centreon:dynamic_service_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA025E77-1B5C-4E14-811D-F792671B4373",
              "versionEndExcluding": "24.04.8",
              "versionStartIncluding": "24.04.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:dynamic_service_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00C3C1F1-7FE8-4B51-B361-70BFD3A4952A",
              "versionEndExcluding": "24.10.4",
              "versionStartIncluding": "24.10.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:dynamic_service_management:25.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDC770A2-4AA6-4C27-94FB-5F432154340C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
}