PT-2019-4359 · Centreon+1 · Centreon Vm+1

Guillaume Quéré · Published 2019-10-08 · Updated 2022-05-24 · CVE-2019-17104

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Centreon VM versions prior to 19.04.3 Apache HTTP Server (affected versions not specified)

Description The issue is related to errors in processing cookie files in the Apache HTTP Server within the Centreon VM. This can allow a remote attacker to disclose protected information. Specifically, the cookie configuration does not protect against theft because the HTTPOnly flag is not set.

Recommendations For Centreon VM versions prior to 19.04.3, update to version 19.04.3 or later to resolve the issue. As a temporary workaround, consider setting the HTTPOnly flag for cookies in the Apache HTTP Server configuration to protect against cookie theft.

Fix

Weakness Enumeration

CWE-565

Related Identifiers

BDU:2020-00080

CVE-2019-17104

GHSA-J224-7QR4-8646

Affected Products

Apache Http Server

Centreon Vm

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2019-17104 · Security Note
• https://osv.dev/vulnerability/GHSA-j224-7qr4-8646 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00080 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17104 · Vendor Advisory
• https://github.com/centreon/centreon-archived · Note
• https://github.com/centreon/centreon-archived/issues/7097 · Note
• https://github.com/centreon/centreon/issues/7097 · Note
• https://openwall.com/lists/oss-security/2019/10/09/2 · Note
• https://docs.centreon.com/current/en/administration/secure-platform.html#securing-the-apache-web-server · Note
• https://openwall.com/lists/oss-security/2019/10/08/1 · Note
• http://openwall.com/lists/oss-security/2019/10/09/2 · Note