PT-2018-14896 · Centreon · Centreon

Published 2018-11-14 · Updated 2022-05-14 · CVE-2018-19271

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Centreon versions 3.4.x

Description The issue allows SQL Injection via the searchH parameter in the main.php file.

Recommendations For Centreon versions 3.4.x, update to Centreon 18.10.0 or Centreon web 2.8.28 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-19271

GHSA-79HG-357G-RRGV

Affected Products

Centreon

References · 8

• 🔥 http://rootlabs.com.br/authenticated-sql-injection-in-centreon-3-4-x · Exploit
• https://osv.dev/vulnerability/CVE-2018-19271 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79hg-357g-rrgv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19271 · Security Note
• https://github.com/centreon/centreon-archived/pull/6625 · Note
• https://github.com/centreon/centreon/pull/6625 · Note
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html · Note
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.28.html · Note