Login Request a demo
Medium severity · published May 13, 2025
CVE-2025-4647
A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
web · Centreon
24.10.0 before 24.10.5; 24.04.0 before 24.04.11; 23.10.0 before 23.10.22; 23.04.0 before 23.04.27; 22.10.0 before 22.10.29 · source: vendor
CW
Centreon Web · Centreon
22.10.0 before 22.10.29; 23.04.0 before 23.04.27; 23.10.0 before 23.10.22; 24.04.0 before 24.04.11; 24.10.0 before 24.10.5 · source: NVD
Affected product
WE
web
Centreon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4647
Release Notes
https://github.com/centreon/centreon/releases
Vendor Advisory
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55574-centreon-web-high-severity-4435
More from web
9.8
CVE-2026-2750
Command Injection via CLAPI generatetraps
8.8
CVE-2025-6791
Second order SQL injection available to user with low privilege
7.2
CVE-2025-4650
User with high privileges is able to introduce a SQLi using the Meta Service indicator page
7.2
CVE-2025-4646
A high privilege user is able to create and use a valid admin API token in centreon-web
5.9
CVE-2025-4648
A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.