Open Tickets
Monthly
Path traversal in Centreon Open Tickets module allows authenticated attackers to read or write files outside intended directories. CVSS 9.9 with scope change indicates impact beyond the vulnerable component.
Stored cross-site scripting in Centreon Infra Monitoring lets authenticated users with elevated privileges inject script into Notification rules or the Open Tickets module, which then executes in another user's browser when the affected page is viewed. Affected releases are 24.10.0 before 24.10.5, 24.04.0 before 24.04.5, and 23.10.0 before 23.10.4. Exploitation requires high privileges and user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), EPSS is 0.24%, no public exploit was identified at time of analysis, and vendor patches are available.
SQL injection in the Centreon Open Tickets module enables authenticated users with elevated (administrative) privileges to execute arbitrary SQL through notification-rule configuration parameters and Open Tickets module inputs. The flaw affects Open Tickets 24.10.0-24.10.4, 24.04.0-24.04.4, and 23.10.0-23.10.3 when the module is installed. Vendor patches are available in 24.10.5, 24.04.5, and 23.10.4; EPSS is low (0.31%) and no public exploit has been identified at the time of analysis, making this a genuine but bounded risk.
Path traversal in Centreon Open Tickets module allows authenticated attackers to read or write files outside intended directories. CVSS 9.9 with scope change indicates impact beyond the vulnerable component.
Stored cross-site scripting in Centreon Infra Monitoring lets authenticated users with elevated privileges inject script into Notification rules or the Open Tickets module, which then executes in another user's browser when the affected page is viewed. Affected releases are 24.10.0 before 24.10.5, 24.04.0 before 24.04.5, and 23.10.0 before 23.10.4. Exploitation requires high privileges and user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), EPSS is 0.24%, no public exploit was identified at time of analysis, and vendor patches are available.
SQL injection in the Centreon Open Tickets module enables authenticated users with elevated (administrative) privileges to execute arbitrary SQL through notification-rule configuration parameters and Open Tickets module inputs. The flaw affects Open Tickets 24.10.0-24.10.4, 24.04.0-24.04.4, and 23.10.0-23.10.3 when the module is installed. Vendor patches are available in 24.10.5, 24.04.5, and 23.10.4; EPSS is low (0.31%) and no public exploit has been identified at the time of analysis, making this a genuine but bounded risk.