« Volver al listado

CVE-2025-12513

Estado: AnalizadaMedia (4.8)—

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges.

This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Centreon — Centreon WEB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-12513",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-12513",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-05T21:18:55.475622Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "affectedData": [
        {
          "vendor": "Centreon",
          "modules": [
            "Hosts configuration form"
          ],
          "product": "Infra Monitoring",
          "versions": [
            {
              "status": "affected",
              "version": "25.10.0",
              "lessThan": "25.10.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.04.0",
              "lessThan": "24.04.19",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-05T14:15:53.277",
  "references": [
    {
      "url": "https://github.com/centreon/centreon/releases",
      "tags": [
        "Release Notes"
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
    },
    {
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-12513-centreon-web-medium-severity-5360",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges.\n\nThis issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19."
    },
    {
      "lang": "es",
      "value": "Neutralización Inadecuada de Entrada Durante la Generación de Páginas Web (XSS o 'cross-site scripting') vulnerabilidad en Centreon Infra Monitoring (módulos del formulario de configuración de Hosts) permite XSS Almacenado a usuarios con altos privilegios.\n\nEste problema afecta a Infra Monitoring: desde 25.10.0 antes de 25.10.2, desde 24.10.0 antes de 24.10.15, desde 24.04.0 antes de 24.04.19."
    }
  ],
  "lastModified": "2026-06-17T08:32:30.823",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "440A575D-6C68-4894-A4DB-C62065FE0349",
              "versionEndExcluding": "24.04.19",
              "versionStartIncluding": "24.04.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE9F2C39-E778-4EFE-8E0B-14D5174A717D",
              "versionEndExcluding": "24.10.15",
              "versionStartIncluding": "24.10.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1842C772-1AC5-49B3-A209-2B8AD6C31134",
              "versionEndExcluding": "25.10.2",
              "versionStartIncluding": "25.10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
}