Lucene search

[email protected]CVE-2020-13628

HistoryMay 27, 2020 - 4:15 p.m.

CVE-2020-13628

2020-05-2716:15:12

CWE-79

[email protected]

web.nvd.nist.gov

cve-2020-13628

cross-site scripting

xss

vulnerability

centreon

widgets

remote code injection

web security

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

48.2%

JSON

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.

Affected configurations

NVD

Node

centreoncentreon_host-monitoring_widgetRange<1.6.4

centreoncentreon_host-monitoring_widgetRange18.10.0–18.10.3

centreoncentreon_host-monitoring_widgetRange19.0.0–19.0.1

centreoncentreon_host-monitoring_widgetRange19.04.0–19.04.3

Node

centreoncentreon_tactical-overview_widgetRange<1.0.3

centreoncentreon_tactical-overview_widgetRange18.10.0–18.10.1

centreoncentreon_tactical-overview_widgetRange19.04.0–19.04.1

centreoncentreon_tactical-overview_widgetRange19.10.0–19.10.1

Node

centreoncentreon_service-monitoring_widgetRange<1.6.4

centreoncentreon_service-monitoring_widgetRange18.10.0–18.10.5

centreoncentreon_service-monitoring_widgetRange19.04.0–19.04.3

centreoncentreon_service-monitoring_widgetRange19.10.0–19.10.2

CPENameOperatorVersion
centreon:centreon_host-monitoring_widgetcentreon centreon host-monitoring widgetlt1.6.4
centreon:centreon_host-monitoring_widgetcentreon centreon host-monitoring widgetlt18.10.3
centreon:centreon_host-monitoring_widgetcentreon centreon host-monitoring widgetlt19.0.1
centreon:centreon_host-monitoring_widgetcentreon centreon host-monitoring widgetlt19.04.3

CPE	Name	Operator	Version
centreon:centreon_host-monitoring_widget	centreon centreon host-monitoring widget	lt	1.6.4
centreon:centreon_host-monitoring_widget	centreon centreon host-monitoring widget	lt	18.10.3
centreon:centreon_host-monitoring_widget	centreon centreon host-monitoring widget	lt	19.0.1
centreon:centreon_host-monitoring_widget	centreon centreon host-monitoring widget	lt	19.04.3

References

sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

48.2%

JSON

Related for CVE-2020-13628

prion1 cvelist1 ubuntucve1 nvd1 osv1 checkpoint_advisories1