CVE-2020-13628

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-05-27 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.

Affected products

Centreon Host-Monitoring Widget: before 1.6.4; from 18.10.0 before 18.10.3; from 19.0.0 before 19.0.1; from 19.04.0 before 19.04.3 — fixed in 1.6.4, 18.10.3, 19.0.1, 19.04.3
Centreon Service-Monitoring Widget: before 1.6.4; from 18.10.0 before 18.10.5; from 19.04.0 before 19.04.3; from 19.10.0 before 19.10.2 — fixed in 1.6.4, 18.10.5, 19.04.3, 19.10.2
Centreon Tactical-Overview Widget: before 1.0.3; from 18.10.0 before 18.10.1; from 19.04.0 before 19.04.1; from 19.10.0 before 19.10.1 — fixed in 1.0.3, 18.10.1, 19.04.1, 19.10.1

How to fix

Upgrade to a fixed version: Centreon Host-Monitoring Widget 1.6.4, 18.10.3, 19.0.1, 19.04.3; Centreon Service-Monitoring Widget 1.6.4, 18.10.5, 19.04.3, 19.10.2; Centreon Tactical-Overview Widget 1.0.3, 18.10.1, 19.04.1, 19.10.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-13628 or the next vulnerability affects your stack