CVE-2025-4648: A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.
The content of a SVG file, received as input
in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4648?
CVE-2025-4648 is classified as a high-severity vulnerability due to its potential for reflected XSS attacks.
How do I fix CVE-2025-4648?
To fix CVE-2025-4648, upgrade Centreon Web to version 24.10.5 or later, or apply a relevant patch if available.
What impact can CVE-2025-4648 have on my Centreon Web application?
CVE-2025-4648 can allow a user with elevated privileges to inject malicious scripts via manipulated SVG media, leading to reflected XSS.
Which versions of Centreon are affected by CVE-2025-4648?
CVE-2025-4648 affects Centreon Web versions from 24.10.0 up to 24.10.5, and several older versions as well.
Is there a workaround for CVE-2025-4648 prior to applying a fix?
There is no publicly documented workaround for CVE-2025-4648, so immediate upgrading is recommended.