LiveActive security incident?Get immediate response
CVE Record

CVE-2021-27676: Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability.

Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-27676 is a stored cross-site scripting issue in Centreon 20.10.2. Malicious content placed in dependency name or description fields could later run in another user's browser inside the Centreon interface. The source bundle does not provide CVSS, a vendor advisory, or evidence of active exploitation.

Executive priority

Treat this as a targeted application security maintenance item, not an emergency unless untrusted users have Centreon configuration access. Prioritize version validation, access control review, and vendor update confirmation.

Technical view

The reported vulnerable inputs are dep_description and dep_name on the Configuration > Notifications > Hosts workflow. The issue requires an authenticated user and affects Centreon version 20.10.2. Public metadata is sparse: vendor/product fields are not populated, no CWE is listed, and the only technical reference is a Centreon GitHub pull request.

Likely exposure

Likely exposure is limited to organizations running Centreon 20.10.2 where authenticated users can access or modify host notification dependency fields. Confirm exposure directly because the CVE record's affected product metadata is incomplete.

Exploitation context

The bundle does not indicate known exploitation, and the CVE is not listed as KEV. Abuse would require authenticated access to the Centreon interface and interaction with stored dependency name or description content.

Researcher notes

Evidence supports stored XSS in two named parameters and an authenticated UI path. The bundle lacks CVSS, CWE, exact fixed version, exploit references, and complete affected-product metadata, so conclusions should remain conservative.

Mitigation direction

  • Inventory Centreon deployments and identify any running version 20.10.2.
  • Review Centreon PR 9587 and vendor release notes for the corrected version.
  • Apply vendor-supported updates or guidance when confirmed.
  • Restrict notification and host configuration access to trusted administrators.
  • Inspect existing dependency names and descriptions for unexpected script-like content.

Validation and detection

  • Confirm the deployed Centreon version on all monitored instances.
  • Check whether authenticated users can edit dependency name or description fields.
  • Review saved dependency names and descriptions for unsafe HTML or JavaScript.
  • Verify whether Centreon guidance maps PR 9587 to an installed fixed release.
  • Review logs for unusual configuration changes around notification dependencies.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-27676 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
2Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.