CVE-2021-27676: 
PHP vulnerability analysis and mitigation

Centreon version 20.10.2 was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was identified in the Configuration > Notifications > Hosts page, specifically in the depdescription (Dependency Description) and depname (Dependency Name) parameters (CVE Mitre, Debian Tracker).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue affecting the depdescription (Dependency Description) and depname (Dependency Name) parameters in Centreon's host notification configuration interface. To access the vulnerable components, a user needs to authenticate and navigate to the Configuration > Notifications > Hosts page (CVE Mitre).

The vulnerability allows attackers to execute arbitrary web scripts or HTML via injected payloads in the affected parameters. Since this is a stored XSS vulnerability, the malicious scripts would be permanently stored in the application and executed whenever other users access the affected pages (CVE Mitre).

Users should upgrade to a version of Centreon that contains the fix for this vulnerability. The issue has been addressed in subsequent releases after version 20.10.2 (Centreon Website).