CVE-2021-27676

An attacker who is already authenticated to Centreon can navigate to Configuration > Notifications > Hosts and inject malicious JavaScript into the `dep_description` or `dep_name` fields [CWE-79]. Because the application does not neutralize user-controllable input before storing it, the payload is persisted in the database. When any other user (including administrators) views the same page, the stored script executes in their browser, enabling session hijacking, credential theft, or further actions within the Centreon session.

The advisory identifies the `dep_description` (Dependency Description) and `dep_name` (Dependency Name) parameters on the Configuration > Notifications > Hosts page as vulnerable to stored XSS. The patch [patch_id=6635466] only removes `package-lock.json` files and does not contain any fix for the XSS vulnerability, so the exact source files where the parameters are rendered unsanitized are not shown in the provided diff.

The provided patch [patch_id=6635466] only removes `package-lock.json` files and does not contain any code change that addresses the stored XSS vulnerability. The advisory does not include a functional fix for the `dep_description` or `dep_name` parameters. Without a proper sanitization or output-encoding patch, the vulnerability remains unmitigated in the supplied diff.