CVE-2025-12519: Centreon Information Disclosure Flaw

CVE-2025-12519 Overview

A Missing Authorization vulnerability has been identified in Centreon Infra Monitoring affecting the Administration parameters API endpoint modules. This security flaw allows unauthorized access to functionality not properly constrained by Access Control Lists (ACLs), resulting in information disclosure of sensitive configuration data including downtime and acknowledgement configurations.

The vulnerability stems from insufficient authorization checks in the API endpoint modules, enabling unauthenticated or low-privileged attackers to access administrative parameters that should be restricted. This represents a significant security concern for organizations using Centreon for infrastructure monitoring, as it could expose critical operational configurations.

Critical Impact

Unauthorized access to sensitive monitoring configurations including downtime schedules and acknowledgement settings, potentially enabling attackers to gather intelligence about infrastructure monitoring practices and operational procedures.

Affected Products

• Centreon Infra Monitoring versions 25.10.0 to 25.10.1 (before 25.10.2)
• Centreon Infra Monitoring versions 24.10.0 to 24.10.14 (before 24.10.15)
• Centreon Infra Monitoring versions 24.04.0 to 24.04.18 (before 24.04.19)

Discovery Timeline

• 2026-01-05 - CVE-2025-12519 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-12519

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a common weakness where the software does not perform authorization checks when an actor attempts to access a resource or perform an action. In the context of Centreon Infra Monitoring, the Administration parameters API endpoint modules fail to properly validate whether requesting users have appropriate permissions to access the requested data.

The vulnerability allows attackers to access functionality that should be restricted by ACLs. When exploited, an attacker can retrieve sensitive information about the monitoring infrastructure's configuration, including how downtime windows are scheduled and how acknowledgement workflows are configured. This information could be leveraged for further reconnaissance or to plan attacks during known maintenance windows.

Root Cause

The root cause of this vulnerability lies in the missing authorization checks within the Administration parameters API endpoint modules. The affected code paths fail to verify that the requesting user or session has the necessary ACL permissions before returning sensitive configuration data. This is a classic authorization bypass scenario where the authentication mechanism may be functioning correctly, but the subsequent authorization checks are absent or improperly implemented.

Attack Vector

The attack vector is network-based, requiring no user interaction and no prior authentication. An attacker with network access to the Centreon web interface can directly query the vulnerable API endpoints to retrieve sensitive configuration information.

The exploitation process involves sending crafted HTTP requests to the Administration parameters API endpoints. Because authorization checks are missing, the server responds with sensitive configuration data regardless of the requester's privilege level.

Key characteristics of the attack vector:

• Network-accessible exploitation requiring no authentication
• No user interaction required for successful exploitation
• Results in disclosure of sensitive configuration data
• Low complexity attack with no prerequisites

Detection Methods for CVE-2025-12519

Indicators of Compromise

• Unusual API requests to Administration parameters endpoints from unauthorized IP addresses or sessions
• Elevated access patterns to /api/ routes related to administration parameters
• Log entries showing successful retrieval of downtime or acknowledgement configurations by non-administrative users
• Unexpected external IP addresses accessing internal Centreon API endpoints

Detection Strategies

• Monitor web server access logs for requests to Administration parameters API endpoints from unusual sources
• Implement API request monitoring to detect unauthorized access attempts to restricted endpoints
• Configure alerting for access patterns that bypass normal authentication workflows
• Review application logs for authorization failures or bypassed access control events
• Deploy Web Application Firewall (WAF) rules to detect and block suspicious API access patterns

Monitoring Recommendations

• Enable detailed logging for all API endpoint access within Centreon
• Implement network segmentation to limit access to Centreon administrative interfaces
• Deploy intrusion detection systems to monitor for reconnaissance activities targeting monitoring infrastructure
• Regularly audit API access logs for anomalous access patterns

How to Mitigate CVE-2025-12519

Immediate Actions Required

• Upgrade Centreon Infra Monitoring to patched versions: 25.10.2, 24.10.15, or 24.04.19 depending on your deployment
• Restrict network access to Centreon administrative interfaces to authorized IP ranges only
• Review access logs for any signs of exploitation prior to patching
• Implement additional network-level access controls if immediate patching is not possible

Patch Information

Centreon has released security patches addressing this vulnerability. Organizations should upgrade to the following versions:

• For 25.10.x branch: Upgrade to version 25.10.2 or later
• For 24.10.x branch: Upgrade to version 24.10.15 or later
• For 24.04.x branch: Upgrade to version 24.04.19 or later

Patches can be obtained from the Centreon Release Notes. Additional details are available in the Centreon Security Bulletin for CVE-2025-12519.

Workarounds

• Implement network-level access restrictions to limit API endpoint access to trusted IP addresses only
• Deploy a reverse proxy or WAF in front of Centreon to filter and monitor API requests
• Disable or restrict access to Administration parameters API endpoints until patching is complete
• Enable enhanced logging and monitoring to detect potential exploitation attempts

# Example: Restrict access to Centreon API endpoints via Apache configuration
<Location "/api/latest/administration">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

# Example: Nginx configuration to restrict API access
location /api/latest/administration {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}