PT-2018-10686 · Centreon · Centreon+1

Published 2018-06-25 · Updated 2022-05-14 · CVE-2018-11587

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Centreon version 3.4.6 Centreon Web version 2.8.23

Description The issue concerns Remote Code Execution via the RPN value in the Virtual Metric form. This is specifically related to the centreonGraph.class.php file.

Recommendations For Centreon version 3.4.6, update to a version that fixes this issue. For Centreon Web version 2.8.23, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the Virtual Metric form in centreonGraph.class.php to minimize the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-11587

GHSA-C8QC-CP8V-PRPX

Affected Products

Centreon

Centreon Web

References · 8

• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11587 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c8qc-cp8v-prpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11587 · Security Note
• https://github.com/centreon/centreon-archived/pull/6263/commits/fb438e6aaf133cc5f9d25130653ba8fdc6ecf51f · Note
• https://github.com/centreon/centreon-archived/pull/6263 · Note
• https://github.com/centreon/centreon/releases · Note
• https://github.com/centreon/centreon/pull/6263 · Note