CVE-2025-8429: A user with elevated privileges can inject XSS in the ACL Action access configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored
XSS by users with elevated privileges.
This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Centreon Infra Monitoringto a version that resolves this vulnerability.Fixed in 24.10.13 - Upgrade
Upgrade
Centreon Infra Monitoringto a version that resolves this vulnerability.Fixed in 24.04.18 - Upgrade
Upgrade
Centreon Infra Monitoringto a version that resolves this vulnerability.Fixed in 23.10.28
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8429?
CVE-2025-8429 has a high severity rating due to its potential for stored XSS attacks.
How do I fix CVE-2025-8429?
To fix CVE-2025-8429, upgrade Centreon Infra Monitoring to version 24.10.14 or later.
Who is affected by CVE-2025-8429?
CVE-2025-8429 affects users with elevated privileges on specific versions of Centreon Infra Monitoring.
What kind of attack can CVE-2025-8429 facilitate?
CVE-2025-8429 can facilitate stored cross-site scripting (XSS) attacks.
When was CVE-2025-8429 published?
CVE-2025-8429 was published in 2025.