PT-2022-23253 · Centreon · Centreon

Saitamang + 2 · Published 2022-08-29 · Updated 2022-09-01 · CVE-2022-36194

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Centreon version 22.04.0

Description The issue is related to a Cross Site Scripting (XSS) attack. It can be exploited from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter. This allows for the execution of malicious scripts. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided. Technical details about exploitation include the use of a crafted payload in the name parameter. The API endpoint /centreon/main.get.php?p=60909 is involved, specifically the section where the "Add" button is clicked and the payload is entered in the "Name" section.

Recommendations For Centreon version 22.04.0, as a temporary workaround, consider disabling the Pollers > Broker Configuration function until a patch is available. Restrict access to the /centreon/main.get.php?p=60909 endpoint to minimize the risk of exploitation. Avoid using the name parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36194

Affected Products

Centreon

References · 6

• 🔥 https://github.com/amdsyad/poc-dump/blob/main/Stored%20XSS%20in%20name%20parameter%20in%20Centreon%20version%2022.04.0 · Exploit
• 🔥 http://packetstormsecurity.com/files/168149/Centreon-22.04.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-36194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36194 · Security Note
• https://t.me/cvenotify/35296 · Telegram Post
• https://t.me/poxek/2420 · Telegram Post