Centreon Web CVE-2025-8459

Exploitation requires an authenticated Centreon account with sufficient rights to create or modify entries in the recurrent downtime scheduler module (PR:L), plus a victim with access to view the affected page (UI:R) - typically an administrator or another operator. The payload is stored, so it fires only when a second user renders the downtime configuration; this delayed, interaction-dependent trigger and the authentication requirement are the primary limiting factors. Affected only on Infra Monitoring versions 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27; instances already on 24.10.13, 24.04.18, 23.10.28 or later are not vulnerable. There is no indication a non-default configuration is needed - the recurrent downtime scheduler is standard Centreon functionality.

This is a moderate-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) that is unlikely to be a top patching priority but should not be ignored on exposed Centreon instances. The CVSS vector requires low-privilege authentication (PR:L) and victim user interaction (UI:R), which meaningfully constrains exploitation compared to an unauthenticated RCE; the scope change (S:C) and Low/Low confidentiality/integrity impact reflect script execution crossing into another user's browser session rather than full system compromise. Supporting signals align with low real-world urgency: EPSS is only 0.25% (15th percentile), the CVE is NOT on CISA KEV, and no public exploit code was provided in the intelligence set - so there is no evidence of active or at-scale exploitation. The signals are therefore consistent rather than conflicting: a vendor-rated moderate issue with low predicted exploitation. The main residual risk is privilege escalation within the monitoring platform - an authenticated low-privilege user storing script that fires in an administrator's session - which matters because monitoring platforms are high-value pivot points, but this remains a targeted, authenticated-insider or compromised-account scenario rather than a mass-exploitation threat.

An authenticated low-privilege Centreon user creates or edits a recurrent downtime schedule, injecting a malicious script payload into a field rendered by the downtime scheduler module. When a higher-privileged user (e.g., an administrator) later views that downtime configuration page, the stored script executes in their browser session, potentially performing actions as that user. No public exploit code was identified in the provided intelligence.