Centreon Infra Monitoring CVE-2025-8429

Attacker must already hold elevated/administrative privileges within Centreon Infra Monitoring (Centreon Web) sufficient to edit the ACL Action access configuration modules, where the malicious payload is stored. Exploitation further requires user interaction (UI:R): a second user must view the poisoned configuration page for the stored script to execute. Affected deployments are Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27; patched releases (24.10.13, 24.04.18, 23.10.28) are available. The key limiting factors are the high-privilege prerequisite and the required victim interaction, which substantially narrow realistic exploitation to environments where privilege boundaries between Centreon operators matter.

This is a genuinely medium/low priority issue rather than an urgent one, and the signals are consistent in pointing that way. The CVSS 3.1 base score is 4.8 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N confirms the core limiting factors: although the attack vector is network (AV:N) with low complexity (AC:L), it requires HIGH privileges (PR:H) - the description independently corroborates this by stating exploitation is 'by users with elevated privileges' - and it requires victim user interaction (UI:R). The impact is limited (C:L/I:L/A:N) with a scope change (S:C), which is typical of stored XSS executing in a victim's browser context. The EPSS score is very low at 0.21% (10th percentile), indicating a low modeled probability of exploitation in the wild, which aligns with the high-privilege precondition. There is no CISA KEV listing and no public exploit identified. All signals agree: a privileged-attacker stored XSS against a monitoring platform is a real but low-urgency finding, best handled in normal patch cycles. No conflicting signals were observed between CVSS, EPSS, and exploitation status.

A Centreon user who already holds elevated/administrative privileges injects a malicious script payload into an ACL Action access configuration module, which is stored server-side. When another privileged user later views the affected configuration page, the script executes in their authenticated browser session, potentially stealing session context or performing actions in the victim's context. No public exploit code was identified at time of analysis.