CVE-2022-40044

Centreon contains cross-site scripting vulnerability via esc_name parameter

5.4 MediumFix available

Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.77%Down 0.1 points since Sep 27, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2022-40044
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 5.4

Record: CVE-2022-40044
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-6939 5.4

Record: EUVD-2022-6939
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rv5q-72p2-2q24 5.4

Centreon contains cross-site scripting vulnerability via esc_name parameter

Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Versions 21.04.16, 21.10.8, and 22.04.2 contain patches.

Record: GHSA-rv5q-72p2-2q24
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-rv5q-72p2-2q24 5.4

Centreon contains cross-site scripting vulnerability via esc_name parameter

Record: GHSA-rv5q-72p2-2q24
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

centreon

Affected packages

Affected packages
Package	Affected	Fixed
`centreon/centreon` Packagist	before 21.04.16	21.04.16
`centreon/centreon` Packagist	21.10.0 up to 21.10.8	21.10.8
`centreon/centreon` Packagist	22.0.0 up to 22.04.1	22.04.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40044 is a medium vulnerability (CVSS 5.4) in Centreon, published September 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in centreon/centreon 21.04.16.