PT-2020-9933 · Centreon · Centreon

Published 2020-03-05 · Updated 2020-08-24 · CVE-2019-17642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Centreon versions prior to 18.10.8 Centreon versions prior to 19.04.2 Centreon versions prior to 19.10.1

Description An issue allows CSRF with resultant remote command execution via shell metacharacters in a POST to "centreon-autodiscovery-server/views/scan/ajax/call.php" in the Autodiscovery plugin.

Recommendations For versions prior to 18.10.8, update to version 18.10.8 or later. For versions prior to 19.04.2, update to version 19.04.2 or later. For versions prior to 19.10.1, update to version 19.10.1 or later.

Fix

CSRF

OS Command Injection

Weakness Enumeration

CWE-352

CWE-78

Related Identifiers

CVE-2019-17642

Affected Products

Centreon

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-17642 · Security Note
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html · Vendor Advisory
• https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17642 · Vendor Advisory
• https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html · Vendor Advisory
• https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html · Vendor Advisory
• https://t.me/cvenotify/1387 · Telegram Post