PT-2021-17732 · Centreon · Centreon Platform

Published 2021-04-15 · Updated 2021-06-08 · CVE-2021-28055

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Centreon Platform version 20.10.0

Description: An issue was discovered in Centreon-Web where the anti-CSRF token generation is predictable. This predictability might allow CSRF attacks, potentially enabling the addition of an admin user.

Recommendations: For Centreon Platform version 20.10.0, update to a version where the anti-CSRF token generation is not predictable to prevent CSRF attacks.

Fix

Use of Insufficiently Random Values

CSRF

Weakness Enumeration

CWE-330

CWE-352

Related Identifiers

CVE-2021-28055

GHSA-7RG4-266C-JQW6

Affected Products

Centreon Platform

References · 9

• https://github.com/centreon/centreon/pull/9612 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-28055 · Security Note
• https://osv.dev/vulnerability/GHSA-7rg4-266c-jqw6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28055 · Vendor Advisory
• https://github.com/centreon/centreon · Note
• https://github.com/centreon/centreon/releases/tag/2.8.37 · Note
• https://github.com/centreon/centreon/commit/0261d4b250135eb513fdb7d52ba6fdeb19c6863f · Note
• https://github.com/centreon/centreon/commit/626d3fb91cef402df0ebda5a8165d8f45da67c7a · Note
• https://github.com/centreon/centreon/releases/tag/19.10.23 · Note