CVE-2025-54892 - A user with elevated privileges can inject XSS in the SNMP traps group configuration page

Back Back to CVE browser

MEDIUM

A user with elevated privileges can inject XSS in the SNMP traps group configuration page

Published Oct 14, 2025

6.8

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules)

allows Stored XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Affected products

Vendor Centreon Product Infra Monitoring Default
unaffected
- Version
  23.10.0
  Status
  affected
  Constraints
  <23.10.28
- Version
  24.04.0
  Status
  affected
  Constraints
  <24.04.18
- Version
  24.10.0
  Status
  affected
  Constraints
  <24.10.13

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Centreon

Infra Monitoring

unaffected

Version	Status	Constraints
23.10.0	affected	<23.10.28
24.04.0	affected	<24.04.18
24.10.0	affected	<24.10.13

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34224
Advisory
https://github.com/centreon/centreon/releases
release-notesRelease Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54892-centreon-web-all-versions-medium-severity-5121
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34224		Advisory
https://github.com/centreon/centreon/releases		release-notesRelease Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54892-centreon-web-all-versions-medium-severity-5121		vendor-advisoryVendor Advisory