Design/Logic Flaw

2018-06-2518:29:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.9%

JSON

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.

CPENameOperatorVersion
centreoneq3.4.6
centreon_webeq2.8.23

CPE	Name	Operator	Version
	centreon	eq	3.4.6
	centreon_web	eq	2.8.23

References

documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html

github.com/centreon/centreon/pull/6259

github.com/centreon/centreon/pull/6260

github.com/centreon/centreon/releases