Login Request a demo
Medium severity · published May 13, 2025
CVE-2025-4648
A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
web · Centreon
24.10.0 before 24.10.5; 24.04.0 before 24.04.11; 23.10.0 before 23.10.22; 23.04.0 before 23.04.27; 22.10.0 before 22.10.29 · source: vendor
CW
Centreon Web · Centreon
22.10.0 before 22.10.29; 23.04.0 before 23.04.27; 23.10.0 before 23.10.22; 24.04.0 before 24.04.11; 24.10.0 before 24.10.5 · source: NVD
Affected product
WE
web
Centreon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4648
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4648
Release Notes
https://github.com/centreon/centreon/releases
Vendor Advisory
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55575-centreon-web-high-severity-4434
More from web
9.8
CVE-2026-2750
Command Injection via CLAPI generatetraps
8.8
CVE-2025-6791
Second order SQL injection available to user with low privilege
7.2
CVE-2025-4650
User with high privileges is able to introduce a SQLi using the Meta Service indicator page
7.2
CVE-2025-4646
A high privilege user is able to create and use a valid admin API token in centreon-web
4.9
CVE-2025-4649
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.