CVE-2025-4649

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/centreon/centreon/releases	Release Notes
https://thewatch.centreon.com/latest-security-bulletins-64/centreon-web-medium-severity-4349	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:centreon:centreon_web::::::::
	cpe:2.3:a:centreon:centreon_web::::::::
	cpe:2.3:a:centreon:centreon_web:24.04.9:::::::*
	cpe:2.3:a:centreon:centreon_web:24.10.3:::::::*

History

No history.

Information

Published : 2025-05-13 12:15

Updated : 2025-10-22 14:05

NVD link : CVE-2025-4649

Mitre link : CVE-2025-4649

CVE.ORG link : CVE-2025-4649

JSON object : View

Products Affected

centreon

centreon_web

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2025-4649", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2025-05-13T12:15:18.047", "references": [{"url": "https://github.com/centreon/centreon/releases", "tags": ["Release Notes"], "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}, {"url": "https://thewatch.centreon.com/latest-security-bulletins-64/centreon-web-medium-severity-4349", "tags": ["Vendor Advisory"], "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.\n\n\n\nACL are not correctly taken into account in the display of the \"event logs\" page. This page requiring, high privileges, will display all available logs.\nThis issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26."}, {"lang": "es", "value": "Una vulnerabilidad de gesti\u00f3n incorrecta de privilegios en la web de Centreon permite la escalada de privilegios. Las ACL no se tienen en cuenta correctamente al mostrar la p\u00e1gina \"event logs\". Esta p\u00e1gina, que requiere privilegios elevados, mostrar\u00e1 todos los registros disponibles. Este problema afecta a la web: desde la versi\u00f3n 24.10.3 hasta la 24.10.4, desde la versi\u00f3n 24.04.09 hasta la 24.04.10, desde la versi\u00f3n 23.10.19 hasta la 23.10.21, desde la versi\u00f3n 23.04.24 hasta la 23.04.26."}], "lastModified": "2025-10-22T14:05:13.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17B674A2-8707-4DD3-A342-61776297310B", "versionEndExcluding": "23.04.26", "versionStartIncluding": "23.04.24"}, {"criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E034ACD-1F07-4E7A-B6A5-9CAF3738C425", "versionEndExcluding": "23.10.21", "versionStartIncluding": "23.10.19"}, {"criteria": "cpe:2.3:a:centreon:centreon_web:24.04.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66FBABD9-B739-4080-9C4D-A4D83325D96D"}, {"criteria": "cpe:2.3:a:centreon:centreon_web:24.10.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E204FCCB-1F12-4BD5-9176-0C3C7E122B34"}], "operator": "OR"}]}], "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}