Centreon Infra Monitoring CVE-2025-54893

Exploitation requires an authenticated attacker holding elevated privileges (PR:H) with access to the Hosts templates configuration module in Centreon Infra Monitoring, and it requires a second user (UI:R) - typically a higher-privileged administrator - to subsequently view the configuration page containing the stored payload. Limiting factors: this is not remotely exploitable by unauthenticated or low-privilege users; the attacker must already be a trusted operator able to edit host template configuration, and the malicious script only fires when a victim opens the affected page. It is confined to the Centreon Web interface and affected versions only (24.10.x <24.10.13, 24.04.x <24.04.18, 23.10.x <23.10.28); patched versions remove the condition.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 base score is 4.8 (Medium), and crucially the vector requires PR:H - an attacker must already hold elevated/administrative privileges in Centreon to inject the stored payload into the Hosts templates configuration - and UI:R, meaning a victim user must subsequently view the poisoned configuration page. The EPSS score is very low (0.21%, 10th percentile), consistent with the limited exploitability of a privilege-gated stored XSS. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent: a low-severity, high-privilege-required flaw with low exploitation probability and no evidence of active exploitation. The primary real-world risk is privilege escalation/lateral abuse by a semi-trusted operator against a higher-privileged administrator (the S:C scope change reflects script execution crossing into the victim's browser security context). No data is strongly conflicting; the main caveat is that CPE strings list 'centreon_web' while the advisory product name is 'Centreon Infra Monitoring,' which appear to refer to the same Centreon Web platform - worth confirming against the vendor bulletin.

A user with elevated (but not top-level) privileges in Centreon injects a malicious script into a Hosts template configuration field. When a higher-privileged administrator later opens that template configuration page, the stored JavaScript executes in their authenticated browser session, potentially hijacking actions or reading limited data. No public exploit code was identified, and exploitation depends on an administrator viewing the poisoned page.