Centreon Infra Monitoring CVE-2025-8460

Exploitation requires an authenticated account with ELEVATED privileges in Centreon Infra Monitoring, sufficient to create or edit Notification rules or Open Tickets module configuration - the exact feature where the unsanitized input is stored. Successful payload execution additionally requires a second victim user to subsequently view the affected page (UI:R), so it cannot fire autonomously. Limiting factors: the high-privilege prerequisite makes this primarily an insider or post-compromise escalation vector rather than an external attack, and only versions below the fixed releases (24.10.5, 24.04.5, 23.10.4) are affected.

This is a genuinely low-to-moderate priority issue, and the signals largely agree. The CVSS 3.1 base score of 4.8 (medium) reflects the key constraint captured in the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N: although the attack vector is network-facing, exploitation requires HIGH privileges (PR:H) AND victim user interaction (UI:R), with only LOW confidentiality/integrity impact and no availability impact. The EPSS score of 0.24% (14th percentile) is consistent with this low practical risk and indicates very little expectation of near-term widespread exploitation. There is no CISA KEV listing (not confirmed actively exploited) and no public exploit code identified in the provided data, so this is not an active-threat item. There is no SSVC decision data provided. Net: this is a real but low-severity stored XSS that depends on an already-privileged, malicious or compromised insider - it is NOT a high-CVSS-but-overrated external risk because the CVSS itself is correctly modest. The scope change (S:C) is the main reason it rates above low, reflecting that injected script executes in another user's authenticated browser session.

A user with elevated Centreon privileges injects a malicious script payload into a Notification rule or an Open Tickets module field, which is stored unsanitized. When another Centreon operator or administrator later views the affected configuration page, the stored script executes in their authenticated browser session. No public exploit code is identified at time of analysis.