CVE-2018-19311

Vulnerability

Centreon versions 3.4.x (prior to 18.10.0) are vulnerable to a stored cross-site scripting (XSS) attack via the Service field on the "Monitoring > Status Details > Services" screen, accessed through the main.php?p=20201 URI [1]. The vulnerability allows arbitrary JavaScript injection into the Service parameter, which is then rendered without proper sanitization.

Exploitation

An authenticated attacker with permission to access the Monitoring > Status Details > Services page can craft a malicious Service value containing JavaScript payloads. When the page is loaded and the injected service data is processed, the script executes in the context of the victim's browser. The attack does not require elevated privileges beyond standard monitoring access.

Impact

Successful exploitation could lead to account hijacking, unauthorized actions performed under the victim's session, disclosure of sensitive monitoring data, or further compromise within the Centreon environment.

Mitigation

The vulnerability is fixed in Centreon 18.10.0 [2][3]. Users running Centreon 3.4.x should upgrade to version 18.10.0 or later. No workarounds are documented.