« Volver al listado

CVE-2025-8459

Estado: AnalizadaMedia (5.4)—

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Centreon — Centreon WEB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-8459",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-8459",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-14T17:52:11.705185Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "affectedData": [
        {
          "vendor": "Centreon",
          "modules": [
            "Monitoring recurrent downtime scheduler"
          ],
          "product": "Infra Monitoring",
          "versions": [
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.13",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "24.04.0",
              "lessThan": "24.04.18",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "23.10.0",
              "lessThan": "23.10.28",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-10-14T18:15:37.490",
  "references": [
    {
      "url": "https://github.com/centreon/centreon/releases",
      "tags": [
        "Release Notes"
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
    },
    {
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8459-centreon-web-all-versions-high-severity-5117",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28."
    }
  ],
  "lastModified": "2026-06-17T10:07:01.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52CE7EB8-492F-4469-9E01-8C63144D785F",
              "versionEndExcluding": "23.10.28",
              "versionStartIncluding": "23.10.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C3C1C61-F2EB-4900-9BB7-C80A6C538E5E",
              "versionEndExcluding": "24.04.18",
              "versionStartIncluding": "24.04.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09800EB4-10FC-4667-9FC8-88D9A8BB2751",
              "versionEndExcluding": "24.10.13",
              "versionStartIncluding": "24.10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"
}