CVE-2021-27676
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
Risk Assessment
An attacker can inject malicious scripts that execute in other administrators' browsers, leading to session theft, configuration changes, or data theft.
Recommendation
Immediately upgrade Centreon to version 20.10.3 or later, which fixes this vulnerability.
Original NVD description (English source)
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.