Security readout for executives and security teams
Plain-English summary
CVE-2020-13627 is a cross-site scripting issue in Centreon monitoring widgets. An attacker could inject script or HTML through a widget parameter, potentially affecting users who view the impacted interface. The provided sources name fixed widget versions but do not provide CVSS scoring or confirmed exploitation.
Executive priority
Treat as a targeted web-application hygiene issue for Centreon environments. Patch during the next security maintenance window, sooner if Centreon is externally exposed or used by privileged administrators.
Technical view
The CVE describes XSS via the widgetId parameter to service-monitoring/src/index.php. Fixed releases are listed for Centreon host-monitoring, service-monitoring, and tactical-overview widgets. The source bundle does not include CWE, CVSS vector, authentication requirements, or detailed exploit conditions.
Likely exposure
Exposure is most likely where Centreon deployments use the affected monitoring widgets and have not upgraded to the listed fixed versions. Internet exposure, authentication requirements, and exact vulnerable version ranges are not fully specified in the provided data.
Exploitation context
No active exploitation is supported by the provided sources, and this CVE is not marked in KEV. The public description confirms script or HTML injection risk, but does not provide exploit maturity, prerequisites, or observed attacks.
Researcher notes
Key gaps are CVSS, CWE, authentication context, and precise vulnerable ranges. The CVE text ties the issue to widgetId handling in service-monitoring/src/index.php and lists fixed versions across three Centreon widgets.
Mitigation direction
- Upgrade affected Centreon widgets to the fixed versions listed in the CVE.
- Prioritize externally reachable or broadly accessible Centreon monitoring portals.
- Check Centreon or vendor guidance for any additional hardening steps.
- Restrict access to Centreon interfaces to trusted users and networks where feasible.
Validation and detection
- Inventory installed Centreon host-monitoring, service-monitoring, and tactical-overview widget versions.
- Confirm versions match or exceed the fixed releases named in the CVE.
- Review web logs for suspicious widgetId activity without reproducing payloads.
- Verify access controls around Centreon monitoring interfaces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-13627 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.