← Advisories

Centreon 2.6.1 Stored Cross-Site Scripting Vulnerability

Medium

Advisory ID

ZSL-2015-5266

Release Date

26 September 2015

Vendor

Centreon - https://www.centreon.com

Affected Version

2.6.1 (CES 3.2)

CVE

N/A

Tested On

CentOS 6.6 (Final), Apache/2.2.15, PHP/5.3.3

Summary

Centreon is the choice of some of the world's largest companies and mission-critical organizations for real-time IT performance monitoring and diagnostics management.

Description

Centreon suffers from a stored XSS vulnerability. Input passed thru the POST parameter 'img_comment' is not sanitized allowing the attacker to execute HTML code into user's browser session on the affected site.

Proof of Concept

centreon_xss.txtTXT

Disclosure Timeline

10.08.2015Vulnerability discovered.

12.08.2015Vendor contacted.

13.08.2015Vendor replies asking more details.

13.08.2015Sent details to the vendor.

14.08.2015Vendor sends details to developing team.

19.08.2015Asked vendor for status update.

19.08.2015Vendor states that some issues were fixed in 2.6.2 and rest will be fixed in 2.6.3 or 2.7.

25.08.2015Asked vendor for status update.

25.08.2015Vendor will get back to us by 15th of September because of holidays.