Medium severity · published May 27, 2020
CVE-2020-10946
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php
6.1
CVSS
2.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Centreon Host-monitoring Widget · Centreon
before 1.6.4; 18.10.0 before 18.10.3; 19.0.0 before 19.0.1; 19.04.0 before 19.04.3 · source: NVD
CS
Centreon Service-monitoring Widget · Centreon
before 1.6.4; 18.10.0 before 18.10.5; 19.04.0 before 19.04.3; 19.10.0 before 19.10.2 · source: NVD
CT
Centreon Tactical-overview Widget · Centreon
before 1.0.3; 18.10.0 before 18.10.1; 19.04.0 before 19.04.1; 19.10.0 before 19.10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10946
Exploit
https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/
More from Centreon Host-monitoring Widget
6.1
CVE-2020-13628
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php
6.1
CVE-2020-13627
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php