CVE-2025-13056: A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules)
allows Stored XSS to users with high privileges.
This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13056?
CVE-2025-13056 has a high severity rating due to its potential for Stored Cross-site Scripting (XSS) vulnerabilities.
How do I fix CVE-2025-13056?
To fix CVE-2025-13056, it's recommended to update Centreon Infra Monitoring to versions 25.10.3 or later, or 24.10.16 or later.
What versions of Centreon Infra Monitoring are affected by CVE-2025-13056?
CVE-2025-13056 affects Centreon Infra Monitoring versions from 24.04.0 to 24.04.19, 24.10.0 to 24.10.15, and 25.10.0 to 25.10.2.
Who is impacted by CVE-2025-13056?
Users with high privileges in the Centreon Infra Monitoring application are impacted by CVE-2025-13056.
What type of vulnerability is CVE-2025-13056?
CVE-2025-13056 is classified as an Improper Neutralization of Input During Web Page Generation, specifically an XSS vulnerability.