CVE-2025-4649

ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.

State: Published
Severity: 4.9 Medium
Published: May 13, 2025
Updated: Oct 15, 2025
Reserved: May 13, 2025

Read the record on cve.org

Description

Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation.

ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. This issue affects web: from 24.10.3 before 24.10.4, from 24.04.09 before 24.04.10, from 23.10.19 before 23.10.21, from 23.04.24 before 23.04.26.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	Centreon

Weaknesses

CWE-755 Improper Handling of Exceptional Conditions

Affected Products

Product	Versions
webCentreon	24.10.3 to before 24.10.4Affected 24.04.09 to before 24.04.10Affected 23.10.19 to before 23.10.21Affected 23.04.24 to before 23.04.26Affected

References

https://thewatch.centreon.com/latest-security-bulletins-64/centreon-web-medium-severity-4349vendor-advisory
https://github.com/centreon/centreon/releasesrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.