CVE-2025-12511

Опубликовано: 05 янв. 2026

Источник: nvd

CVSS3: 6.8

CVSS3: 4.8

EPSS Низкий

Описание

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS

to user with elevated privileges.

This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8.

Ссылки

https://github.com/centreon/centreon/releases
Release Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-12511-centreon-dsm-medium-severity-5361
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:centreon:dynamic_service_management:*:*:*:*:*:*:*:*

Версия от 24.04.0 (включая) до 24.04.8 (исключая)

cpe:2.3:a:centreon:dynamic_service_management:*:*:*:*:*:*:*:*

Версия от 24.10.0 (включая) до 24.10.4 (исключая)

cpe:2.3:a:centreon:dynamic_service_management:25.10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 1%

0.00008

Низкий

6.8 Medium

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-p4qh-f4fg-63x2

CVSS3: 6.8

github

около 1 месяца назад

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS to user with elevated privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8.

EPSS

Процентиль: 1%

0.00008

Низкий

6.8 Medium

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-79