CVE-2020-13628
Last modified
CVE-2020-13628 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.. EPSS estimates a 2.23% chance of exploitation in the next 30 days.
Description
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Centreon | Centreon Host-Monitoring Widget | < 1.6.4 |
| Centreon | Centreon Host-Monitoring Widget | >= 18.10.0, < 18.10.3 |
| Centreon | Centreon Host-Monitoring Widget | >= 19.0.0, < 19.0.1 |
| Centreon | Centreon Host-Monitoring Widget | >= 19.04.0, < 19.04.3 |
| Centreon | Centreon Tactical-Overview Widget | < 1.0.3 |
| Centreon | Centreon Tactical-Overview Widget | >= 18.10.0, < 18.10.1 |
| Centreon | Centreon Tactical-Overview Widget | >= 19.04.0, < 19.04.1 |
| Centreon | Centreon Tactical-Overview Widget | >= 19.10.0, < 19.10.1 |
| Centreon | Centreon Service-Monitoring Widget | < 1.6.4 |
| Centreon | Centreon Service-Monitoring Widget | >= 18.10.0, < 18.10.5 |
| Centreon | Centreon Service-Monitoring Widget | >= 19.04.0, < 19.04.3 |
| Centreon | Centreon Service-Monitoring Widget | >= 19.10.0, < 19.10.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-13628?
How severe is CVE-2020-13628?
How do I fix CVE-2020-13628?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-13620Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 …8.8
- CVE-2020-13622JerryScript 2.2.0 allows attackers to cause a denial of serv…7.5
- CVE-2020-13623JerryScript 2.2.0 allows attackers to cause a denial of serv…7.5
- CVE-2020-13625PHPMailer before 6.1.6 contains an output escaping bug when …7.5
- CVE-2020-13626OnePlus App Locker through 2020-10-06 allows physically prox…4.6
- CVE-2020-13627Cross-site scripting (XSS) vulnerability allows remote attac…6.1
- CVE-2020-1363An elevation of privilege vulnerability exists when the Wind…7.8
- CVE-2020-13630ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free…7
- CVE-2020-13631SQLite before 3.32.0 allows a virtual table to be renamed to…5.5
- CVE-2020-13632ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL p…5.5
- CVE-2020-13633Fork before 5.8.3 allows XSS via navigation_title or title.6.1
- CVE-2020-13634In Windows Master (aka Windows Optimization Master) 7.99.13.…7.8
Are you affected by CVE-2020-13628?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST