{"id":"CVE-2021-27676","aliases":["EUVD-2021-1393","GHSA-r5mf-q76q-f2xq"],"status":"published","title":"Cross-site scripting in Centreon","description":"Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration \u003e Notifications \u003e Hosts page.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00619,"percentile":0.50141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-05-26T10:20:38Z","modified":"2026-09-10T03:49:26Z","fixes":[{"ecosystem":"Packagist","package":"centreon/centreon","fixed_in":["20.10.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"centreon/centreon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"centreon/centreon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.7"}]}]}],"products":[{"vendor":"centreon","product":"centreon"}],"references":[{"url":"https://github.com/centreon/centreon/pull/9587","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27676","tags":["advisory"]},{"url":"https://github.com/centreon/centreon/releases/tag/20.10.7","tags":["web"]},{"url":"http://centreon.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r5mf-q76q-f2xq"}],"sources":{"cve":[{"id":"CVE-2021-27676","description":"Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration \u003e Notifications \u003e Hosts page.","status":"published","published":"2021-05-26T10:20:38Z","modified":"2026-07-09T00:12:46.625Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-1393","description":"Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration \u003e Notifications \u003e Hosts page.","status":"published","published":"2021-05-26T10:20:38Z","modified":"2026-07-09T00:12:46Z","updated_at":"2026-11-02T18:20:09.112703Z"}],"ghsa":[{"id":"GHSA-r5mf-q76q-f2xq","title":"Cross-site scripting in Centreon","description":"Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration \u003e Notifications \u003e Hosts page.","status":"published","published":"2021-06-08T20:13:05Z","modified":"2023-02-01T05:06:07Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:37.441118Z"}],"nvd":[{"id":"CVE-2021-27676","description":"Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration \u003e Notifications \u003e Hosts page.","status":"published","published":"2021-05-26T11:15:08.89Z","modified":"2026-07-09T01:16:48.85Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"GHSA-r5mf-q76q-f2xq","title":"Cross-site scripting in Centreon","description":"Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration \u003e Notifications \u003e Hosts page.","status":"published","published":"2021-06-08T20:13:05Z","modified":"2026-09-10T03:49:26.936106244Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}