PT-2020-20677 · Centreon · Centreon

Code16 · Published 2020-02-28 · Updated 2020-03-03 · CVE-2020-9463

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Centreon version 19.10

Description The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server ip field in JSON data in an "api/internal.php?object=centreon configuration remote" request.

Recommendations For Centreon version 19.10, as a temporary workaround, consider restricting access to the "api/internal.php?object=centreon configuration remote" endpoint until a patch is available. Avoid using the server ip field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-9463

Affected Products

Centreon

References · 4

• 🔥 https://code610.blogspot.com/2020/02/postauth-rce-in-centreon-1910.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-9463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9463 · Security Note
• https://t.me/cvenotify/1280 · Telegram Post