CVE-2020-13628 - CVE House
Back to Database
Status published Medium CVE-2020-13628

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary...

Vulnerability Description

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-13628

Credits & Attribution

No credits recorded in the NVD database.

References

More from centreon

View All →
CVE-2022-40044
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS)...
Unknown 0
CVE-2022-40043
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability...
Unknown 0
CVE-2022-39988
A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers...
Medium 5.4
CVE-2022-36194
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from...
Medium 5.4
CVE-2021-37558
A SQL injection vulnerability in a MediaWiki script in Centreon...
Critical 9.8

Affected Vendor

Affected Software

centreon host-monitoring widget, centreon tactical-overview widget, centreon service-monitoring widget
Vulnerable Versions:
0, 18.10.0, 19.0.0, 19.04.0, 19.10.0

Timeline

Official Publish: May 27th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.