PT-2018-10686 · Centreon · Centreon+1

Publicado 2018-06-25 · Atualizado 2022-05-14 · CVE-2018-11587

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Centreon version 3.4.6 Centreon Web version 2.8.23

Description The issue concerns Remote Code Execution via the RPN value in the Virtual Metric form. This is specifically related to the centreonGraph.class.php file.

Recommendations For Centreon version 3.4.6, update to a version that fixes this issue. For Centreon Web version 2.8.23, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the Virtual Metric form in centreonGraph.class.php to minimize the risk of exploitation.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-11587

GHSA-C8QC-CP8V-PRPX

Produtos afetados

Centreon

Centreon Web

Referências · 8

• https://github.com/centreon/centreon-archived/pull/6263/commits/fb438e6aaf133cc5f9d25130653ba8fdc6ecf51f · Nota
• https://github.com/centreon/centreon-archived/pull/6263 · Nota
• https://github.com/centreon/centreon/releases · Nota
• https://github.com/centreon/centreon/pull/6263 · Nota
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-11587 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c8qc-cp8v-prpx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11587 · Nota de Segurança