CVE-2025-12513 Overview
CVE-2025-12513 is a stored cross-site scripting (XSS) vulnerability in Centreon Infra Monitoring. The flaw resides in the Hosts configuration form modules of Centreon Web. An authenticated attacker with high privileges can inject malicious script content that persists in the application. The payload executes in the browser context of any user who subsequently views the affected page.
The vulnerability is classified under CWE-79 for improper neutralization of input during web page generation. Centreon assigned this issue medium severity and published patched releases across three supported branches.
Critical Impact
Stored XSS execution in administrator browser sessions enables session theft, configuration tampering, and privileged action abuse across the monitoring platform.
Affected Products
- Centreon Infra Monitoring 25.10.0 before 25.10.2
- Centreon Infra Monitoring 24.10.0 before 24.10.15
- Centreon Infra Monitoring 24.04.0 before 24.04.19
Discovery Timeline
- 2026-01-05 - CVE-2025-12513 published to NVD
- 2026-01-26 - Last updated in NVD database
Technical Details for CVE-2025-12513
Vulnerability Analysis
The vulnerability resides in the Hosts configuration form modules within Centreon Web. The application fails to neutralize attacker-controlled input before rendering it into HTML output. An authenticated user with high privileges can submit crafted values through host configuration fields. Centreon stores these values and later serves them to other authenticated users without proper output encoding.
This is a stored XSS pattern, meaning the payload persists in the database. Every subsequent request that renders the affected configuration page executes the injected script. Exploitation requires user interaction from the victim, who must navigate to the affected page.
Root Cause
The root cause is improper neutralization of user-supplied input during web page generation, tracked as CWE-79. Centreon Web does not consistently apply output encoding or input sanitization on host configuration fields. As a result, HTML and JavaScript metacharacters submitted by privileged users are rendered as active markup.
Attack Vector
The attack requires network access to the Centreon Web interface and authenticated credentials with high privileges. The attacker submits a malicious payload through a Hosts configuration form field. When another administrator or operator opens the affected configuration view, the script executes within their session context.
Impact includes theft of session tokens, forced configuration changes, and pivoting to other Centreon components rendered in the same origin. Because the scope is changed (S:C), the injected code can affect resources beyond the vulnerable component itself.
No verified public proof-of-concept code is available for this issue. Refer to the Centreon Security Bulletin CVE-2025-12513 for vendor-supplied technical context.
Detection Methods for CVE-2025-12513
Indicators of Compromise
- Unexpected <script> tags, event handlers, or JavaScript URIs stored in Centreon host configuration fields such as host name, alias, or notes
- Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after accessing the Hosts configuration page
- Unexpected configuration changes, new admin accounts, or modified poller settings following privileged user sessions
Detection Strategies
- Query the Centreon database for host configuration records containing HTML control characters such as <, >, onerror=, or javascript: substrings
- Inspect web server access logs for POST requests to host configuration endpoints submitting payloads with script syntax
- Review browser Content Security Policy (CSP) violation reports for inline script blocks originating from Centreon Web pages
Monitoring Recommendations
- Enable audit logging on Centreon for all host configuration create, update, and delete operations, and forward events to a central SIEM
- Correlate privileged Centreon user activity with downstream session anomalies such as new API tokens or unexpected logins
- Alert on access to the Hosts configuration module from accounts that do not normally administer monitoring objects
How to Mitigate CVE-2025-12513
Immediate Actions Required
- Upgrade Centreon Infra Monitoring to version 25.10.2, 24.10.15, or 24.04.19 according to your installed branch
- Audit existing host configuration entries for stored script payloads and remove or sanitize any suspicious values
- Rotate session tokens and API keys for high-privilege Centreon accounts after patching
Patch Information
Centreon released fixed versions 25.10.2, 24.10.15, and 24.04.19 that address the improper neutralization in the Hosts configuration form modules. See the Centreon Release Notes and the Centreon Security Bulletin CVE-2025-12513 for upgrade instructions and version-specific guidance.
Workarounds
- Restrict access to the Hosts configuration module to a minimal set of trusted administrators until patches are applied
- Enforce a strict Content Security Policy on the Centreon Web vhost to block inline scripts where supported
- Place the Centreon Web interface behind a web application firewall with rules that inspect host configuration form submissions for HTML and JavaScript metacharacters
# Example upgrade commands for supported Centreon branches
# 25.10.x branch
sudo dnf update centreon-web --refresh
# 24.10.x branch
sudo dnf update centreon-web-24.10
# 24.04.x branch
sudo dnf update centreon-web-24.04
# Verify the installed version after upgrade
rpm -q centreon-web
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
