Centreon Infra Monitoring CVE-2025-8428

Exploitation requires an authenticated account with at least low privileges (PR:L) sufficient to configure an HTTP Loader widget, and a separate victim user who must subsequently view the dashboard rendering that widget (UI:R). The specific vulnerable feature is the HTTP Loader widget module within Centreon Infra Monitoring's dashboard/widget subsystem. Limiting factors: the attacker cannot act purely unauthenticated, the payload only fires when another user opens the affected widget, and impact is confined to the victim's browser session rather than the Centreon server itself. Affected deployments are Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27.

This is a moderate-severity stored XSS (CWE-79) in Centreon Infra Monitoring's HTTP Loader widget, rated CVSS 5.4. The signals are internally consistent and point to a genuine-but-not-urgent issue rather than a top priority. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network reachability and low attack complexity, but requires authenticated low-privilege access (PR:L) and victim interaction (UI:R) - a privileged user must view the poisoned widget for the payload to fire. EPSS is low at 0.25% (15th percentile), consistent with the absence of any KEV listing or public POC, so there is no evidence of active or imminent exploitation. The scope change (S:C) and low confidentiality/integrity impact reflect typical stored-XSS session abuse (cookie/session theft, actions in the victim's browser context) rather than direct server compromise. No conflicting signals are present; the chief caveat is that no independent POC or exploitation telemetry exists, so risk rests on vendor and NVD metadata alone.

An authenticated low-privilege Centreon user injects a malicious JavaScript payload into an HTTP Loader widget's configuration, which is stored and later rendered when another user (e.g., an administrator) opens the dashboard containing that widget. When the victim views the widget, the script executes in their browser session, enabling session-token theft or actions performed as the victim. No public exploit code has been identified at time of analysis.