Centreon Web CVE-2025-54891

Exploitation requires an authenticated account with elevated/administrative privileges in Centreon (PR:H) that can write to the ACL Resource access configuration modules - this is the exact feature where the stored payload is planted. It additionally requires a second user to subsequently open/view the affected configuration page for the stored script to execute (UI:R), so it cannot be triggered without victim interaction. Limiting factors: the attacker must already possess elevated Centreon privileges (not an unauthenticated or low-privilege vector), the payload only fires in the browser of a user who views the poisoned module, and only the specified Infra Monitoring versions below 24.10.13 / 24.04.18 / 23.10.28 are affected.

This is a genuinely medium/low-priority issue, not an inflated high-CVSS alarm. The CVSS 3.1 base score is 4.8 (medium), and every signal aligns with low real-world urgency: EPSS is 0.26% (16th percentile), it is NOT listed in CISA KEV, and no public exploit code was identified in the provided data. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) is the dominant limiting factor - PR:H means the attacker must already hold elevated/administrative privileges within Centreon, and UI:R means a victim must subsequently view the poisoned configuration page. This is a stored XSS exploitable only by a privileged insider (or an already-compromised privileged account) against other users, so it is a privilege-escalation/lateral-impact concern rather than a remotely-triggerable unauthenticated flaw. The scope-change (S:C) and C:L/I:L reflect that injected script executes in a victim's authenticated browser session, potentially affecting a different security context (e.g., a higher-privileged operator). No signals conflict here: low EPSS, no KEV, no POC, and a high-privilege precondition all point the same direction. Treat as routine-patch priority unless privileged account hygiene is weak.

A user with elevated Centreon privileges injects malicious JavaScript into an ACL Resource access configuration field, which is stored and later rendered when another administrator or operator opens the affected configuration module. When that victim views the page, the script runs in their authenticated session, enabling session/token theft or actions in their security context. No public exploit code was identified, and exploitation requires both pre-existing high privileges and a victim viewing the page (UI:R).