CVE-2020-10946

Name of the Vulnerable Software and Affected Versions Centreon host-monitoring widget versions prior to 1.6.4, 18.10.3, 19.04.3, and 19.0.1 Centreon service-monitoring widget versions prior to 1.6.4, 18.10.5, 19.04.3, and 19.10.2 Centreon tactical-overview widget versions prior to 1.0.3, 18.10.1, 19.04.1, and 19.10.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php.

Recommendations For Centreon host-monitoring widget versions prior to 1.6.4, 18.10.3, 19.04.3, and 19.0.1, update to version 1.6.4, 18.10.3, 19.04.3, or 19.0.1. For Centreon service-monitoring widget versions prior to 1.6.4, 18.10.5, 19.04.3, and 19.10.2, update to version 1.6.4, 18.10.5, 19.04.3, or 19.10.2. For Centreon tactical-overview widget versions prior to 1.0.3, 18.10.1, 19.04.1, and 19.10.1, update to version 1.0.3, 18.10.1, 19.04.1, or 19.10.1. As a temporary workaround, consider restricting access to the service-monitoring/src/index.php endpoint until a patch is available.