CVE-2022-40044: Centreon contains cross-site scripting vulnerability via esc_name parameter
Centreon contains cross-site scripting vulnerability via escname parameter
Other sources
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the escname (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Versions 21.04.16, 21.10.8, and 22.04.2 contain patches.
— GitHub
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the escname (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/centreon/centreonto a version that resolves this vulnerability.Fixed in 22.04.1 - Upgrade
Upgrade
composer/centreon/centreonto a version that resolves this vulnerability.Fixed in 21.10.8 - Upgrade
Upgrade
composer/centreon/centreonto a version that resolves this vulnerability.Fixed in 21.04.16 - Upgrade
Upgrade
Centreonto a version that resolves this vulnerability.Fixed in 21.04.16 - Upgrade
Upgrade
Centreonto a version that resolves this vulnerability.Fixed in 21.10.8 - Upgrade
Upgrade
Centreonto a version that resolves this vulnerability.Fixed in 22.04.2
Event History
Frequently Asked Questions
What is the vulnerability ID for Centreon v20.10.18?
The vulnerability ID for Centreon v20.10.18 is CVE-2022-40044.
What is the severity of CVE-2022-40044?
The severity of CVE-2022-40044 is medium with a CVSS score of 5.4.
What is the affected software version of CVE-2022-40044?
The affected software version of CVE-2022-40044 is Centreon v20.10.18.
What is the CWE category of CVE-2022-40044?
The CWE category of CVE-2022-40044 is CWE-79 (Cross-Site Scripting).
How can attackers exploit CVE-2022-40044?
Attackers can exploit CVE-2022-40044 by injecting a crafted payload via the esc_name parameter in Centreon's Configuration/Notifications/Escalations, allowing them to execute arbitrary web scripts or HTML.