CVE-2025-8429: A user with elevated privileges can inject XSS in the ACL Action access configuration page
Published Oct 14, 2025
·Updated
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored
XSS by users with elevated privileges.
This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Affected Software
4 affected components
Centreon Infra Monitoring>=24.10.0, <24.10.13, >=24.04.0, <24.04.18, >=23.10.0, <23.10.28
Centreon Centreon Web>=23.10.0<23.10.28
Centreon Centreon Web>=24.04.0<24.04.18
Centreon Centreon Web>=24.10.0<24.10.13
Event History
Oct 14, 2025
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-8429?
CVE-2025-8429 has a high severity rating due to its potential for stored XSS attacks.
2
How do I fix CVE-2025-8429?
To fix CVE-2025-8429, upgrade Centreon Infra Monitoring to version 24.10.14 or later.
3
Who is affected by CVE-2025-8429?
CVE-2025-8429 affects users with elevated privileges on specific versions of Centreon Infra Monitoring.
4
What kind of attack can CVE-2025-8429 facilitate?
CVE-2025-8429 can facilitate stored cross-site scripting (XSS) attacks.
5
When was CVE-2025-8429 published?
CVE-2025-8429 was published in 2025.