A user with elevated privileges can inject XSS in the ACL Resource Access configuration page
CVE-2025-54891

6.8MEDIUM

Key Information:

Vendor

Centreon

Status
Infra Monitoring
Vendor
CVE Published:
14 October 2025

What is CVE-2025-54891?

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored

XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

Affected Version(s)

Infra Monitoring 24.10.0 < 24.10.13

Infra Monitoring 24.04.0 < 24.04.18

Infra Monitoring 23.10.0 < 23.10.28

References

https://github.com/centreon/centreon/releases
release-notes

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcelo Queiroz
JSON
.
CVE-2025-54891 : Cross-site Scripting Vulnerability in Centreon Infra Monitoring by Centreon