VulnerabilityDeferred

CVE-2024-47863

A stored XSS was found in the user configuration contact name field.

MEDIUM 6.2EPSS 0.60%

Does this matter?

Lower severity and a low EPSS score (0.60%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, and 22.10.x before 22.10.26. A stored XSS was found in the user configuration contact name field. This form is only accessible to authenticated users with high-privilege access.

CVSS 3.1: 6.2 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
EPSS: 0.60% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: cve@mitre.org

References

https://github.com/centreon/centreon/releases
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-47863-centreon-web-medium-severity-4059

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.