PT-2019-4359 · Centreon+1 · Centreon Vm+1

Guillaume Quéré · Publicado 2019-10-08 · Atualizado 2022-05-24 · CVE-2019-17104

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Centreon VM versions prior to 19.04.3 Apache HTTP Server (affected versions not specified)

Description The issue is related to errors in processing cookie files in the Apache HTTP Server within the Centreon VM. This can allow a remote attacker to disclose protected information. Specifically, the cookie configuration does not protect against theft because the HTTPOnly flag is not set.

Recommendations For Centreon VM versions prior to 19.04.3, update to version 19.04.3 or later to resolve the issue. As a temporary workaround, consider setting the HTTPOnly flag for cookies in the Apache HTTP Server configuration to protect against cookie theft.

Correção

Enumeração de Fraquezas

CWE-565

Identificadores relacionados

BDU:2020-00080

CVE-2019-17104

GHSA-J224-7QR4-8646

Produtos afetados

Apache Http Server

Centreon Vm

Referências · 11

• https://github.com/centreon/centreon-archived · Nota
• https://github.com/centreon/centreon-archived/issues/7097 · Nota
• https://github.com/centreon/centreon/issues/7097 · Nota
• https://openwall.com/lists/oss-security/2019/10/09/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17104 · Nota de Segurança
• https://docs.centreon.com/current/en/administration/secure-platform.html#securing-the-apache-web-server · Nota
• https://osv.dev/vulnerability/GHSA-j224-7qr4-8646 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2019/10/08/1 · Nota
• http://openwall.com/lists/oss-security/2019/10/09/2 · Nota
• https://bdu.fstec.ru/vul/2020-00080 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17104 · Aviso do Fabricante