PT-2024-31751 · Centreon · Centreon-Dsm-Server

Ludovic Tavernier + 2 · Published 2024-11-25 · Updated 2024-11-26 · CVE-2024-45755

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Centreon centreon-dsm-server versions 22.10.x through 22.10.2 Centreon centreon-dsm-server versions 23.04.x through 23.04.3 Centreon centreon-dsm-server versions 23.10.x through 23.10.1 Centreon centreon-dsm-server versions 24.04.x through 24.04.3 Centreon centreon-dsm-server versions 24.10.x through 24.10.0

Description: An issue was discovered in the form to configure Centreon DSM slots, allowing SQL injection. This can be exploited by authenticated users with high-privileged access.

Recommendations: For versions 22.10.x through 22.10.2, update to version 22.10.2 or later. For versions 23.04.x through 23.04.3, update to version 23.04.3 or later. For versions 23.10.x through 23.10.1, update to version 23.10.1 or later. For versions 24.04.x through 24.04.3, update to version 24.04.3 or later. For versions 24.10.x through 24.10.0, update to version 24.10.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-45755

Affected Products

Centreon-Dsm-Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-45755 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45755 · Vendor Advisory
• https://github.com/centreon/centreon/releases · Note
• https://twitter.com/CVEnew/status/1861101108921332087 · Twitter Post
• https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-45755-centreon-dsm-high-severity-4066 · Note