PT-2025-20886 · Centreon · Centreon

Benoit Poulet · Published 2025-05-13 · Updated 2025-10-22 · CVE-2025-4649

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Centreon web versions 24.10.3 through 24.10.4 Centreon web versions 24.04.09 through 24.04.10 Centreon web versions 23.10.19 through 23.10.21 Centreon web versions 23.04.24 through 23.04.26

Description: The issue is related to improper privilege management, allowing privilege escalation. Access Control Lists (ACL) are not correctly taken into account when displaying the "event logs" page, which requires high privileges and will display all available logs.

Recommendations: For versions 24.10.3 through 24.10.4, update to version 24.10.4 or later. For versions 24.04.09 through 24.04.10, update to version 24.04.10 or later. For versions 23.10.19 through 23.10.21, update to version 23.10.21 or later. For versions 23.04.24 through 23.04.26, update to version 23.04.26 or later.

Exploit

Fix

LPE

Improper Handling of Exceptional Conditions

Improper Privilege Management

Weakness Enumeration

CWE-755

CWE-269

Related Identifiers

CVE-2025-4649

Affected Products

Centreon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4649.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-4649 · Vendor Advisory
• https://thewatch.centreon.com/latest-security-bulletins-64/centreon-web-medium-severity-4349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4649 · Security Note
• https://github.com/centreon/centreon/releases · Note
• https://twitter.com/CVEnew/status/1922258190844232146 · Twitter Post
• https://t.me/cveNotify/139848 · Telegram Post
• https://t.me/cvetracker/23735 · Telegram Post
• https://t.me/cvenotify/121899 · Telegram Post