CVE-2020-13627: XSS

Q: What is CVE-2020-13627?

CVE-2020-13627 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML.

Q: How can the CVE-2020-13627 vulnerability be exploited?

The CVE-2020-13627 vulnerability can be exploited by injecting arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php.

Q: What is the severity level of CVE-2020-13627?

CVE-2020-13627 has a severity level of medium.

Q: Which versions of Centreon host-monitoring widget are affected by CVE-2020-13627?

Versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget are affected by CVE-2020-13627.

Q: How can I fix the CVE-2020-13627 vulnerability?

To fix the CVE-2020-13627 vulnerability, update to versions 1.6.4, 18.10.3, 19.04.3, or 19.0.1 of the Centreon host-monitoring widget.

Published May 27, 2020

Updated

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.

Affected Software

12 affected components

Centreon Centreon host-monitoring widget<1.6.4

Centreon Centreon host-monitoring widget>=18.10.0<18.10.3

Centreon Centreon host-monitoring widget>=19.0.0<19.0.1

Centreon Centreon host-monitoring widget>=19.04.0<19.04.3

Centreon Centreon tactical-overview widget<1.0.3

Centreon Centreon tactical-overview widget>=18.10.0<18.10.1

Centreon Centreon tactical-overview widget>=19.04.0<19.04.1

Centreon Centreon tactical-overview widget>=19.10.0<19.10.1

Centreon Centreon service-monitoring widget<1.6.4

Centreon Centreon service-monitoring widget>=18.10.0<18.10.5

Centreon Centreon service-monitoring widget>=19.04.0<19.04.3

Centreon Centreon service-monitoring widget>=19.10.0<19.10.2

Event History

May 27, 2020

CVE Published

via MITRE·03:12 PM

Data Sourced

via MITRE·03:12 PM

Description

Frequently Asked Questions

What is CVE-2020-13627?

CVE-2020-13627 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML.

How can the CVE-2020-13627 vulnerability be exploited?

The CVE-2020-13627 vulnerability can be exploited by injecting arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php.

What is the severity level of CVE-2020-13627?

CVE-2020-13627 has a severity level of medium.

Which versions of Centreon host-monitoring widget are affected by CVE-2020-13627?

Versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget are affected by CVE-2020-13627.

How can I fix the CVE-2020-13627 vulnerability?