PT-2024-24618 · Centreon · Centreon Web

Published

2024-06-10

·

Updated

2024-08-28

·

CVE-2024-32501

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Centreon Web versions 22.10.x through 22.10.22 Centreon Web versions 23.04.x through 23.04.18 Centreon Web versions 23.10.x through 23.10.12 Centreon Web versions 24.04.x through 24.04.2
Description A SQL Injection vulnerability exists in the updateServiceHost functionality. This issue affects multiple versions of Centreon Web and can potentially lead to remote code execution. The estimated number of affected devices and real-world incidents are not specified.
Recommendations For Centreon Web version 22.10.x, update to version 22.10.23 to resolve the issue. For Centreon Web version 23.04.x, update to version 23.04.19 to resolve the issue. For Centreon Web version 23.10.x, update to version 23.10.13 to resolve the issue. For Centreon Web version 24.04.x, update to version 24.04.3 to resolve the issue.

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-32501
ZDI-24-596

Affected Products

Centreon Web