Skip to main content

Centreon Web CVE-2025-4649

MEDIUM
Improper Handling of Exceptional Conditions (CWE-755)
2025-05-13 bd4443e6-1eef-43f3-9886-25fc9ceeaae7
Privilege Escalation Centreon Web
4.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 18:41 vuln.today
CVE Published
May 13, 2025 - 12:15 nvd
MEDIUM 4.9

DescriptionCVE.org

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.

ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.

AnalysisAI

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-755. Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26. Affected products include: Centreon Centreon Web. Version information: before 24.10.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Centreon Web

View all
CVE-2019-17107 HIGH POC
8.8 Oct 08

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the comman
CVE-2019-16406 HIGH POC
7.8 Nov 21

Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual ma
CVE-2019-16405 HIGH POC
7.2 Nov 21

Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code
CVE-2019-17108 MEDIUM POC
6.1 Oct 08

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or

CVE-2024-32501 CRITICAL
9.8 Aug 23

A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.1
CVE-2018-11589 CRITICAL
9.8 Jun 25

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU par
CVE-2018-11587 CRITICAL
9.8 Jun 25

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric f
CVE-2024-33854 CRITICAL
9.1 Aug 23

A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x bef
CVE-2024-33853 CRITICAL
9.1 Aug 23

A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before

CVE-2024-33852 CRITICAL
9.1 Aug 23

A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23
CVE-2024-39841 HIGH
8.8 Aug 23

A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3,

CVE-2024-5725 HIGH
8.8 Aug 21

Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabi

Same weakness CWE-755 – Improper Handling of Exceptional Conditions

View all
CVE-2017-5638 CRITICAL POC
9.8
CVE-2018-7852 HIGH POC
7.5
CVE-2022-48328 CRITICAL POC
9.8
CVE-2021-38384 CRITICAL POC
9.8
CVE-2021-36128 CRITICAL POC
9.8
CVE-2020-24753 CRITICAL POC
9.8
CVE-2019-14431 CRITICAL POC
9.8
CVE-2019-12815 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2025-4649 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy