PT-2024-31752 · Centreon · Centreon-Open-Tickets

Ludovic Tavernier + 2 · Published 2024-11-25 · Updated 2024-11-25 · CVE-2024-45756

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Centreon centreon-open-tickets versions 22.10.x through 22.10.1 Centreon centreon-open-tickets versions 23.04.x through 23.04.2 Centreon centreon-open-tickets versions 23.10.x through 23.10.0 Centreon centreon-open-tickets versions 24.04.x through 24.04.1 Centreon centreon-open-tickets versions 24.10.x through 24.09.x

Description: An issue was discovered in Centreon centreon-open-tickets. SQL injection can occur in the form to create a ticket. Exploitation is only accessible to authenticated users with high-privileged access.

Recommendations: For versions 22.10.x through 22.10.1, update to version 22.10.2 or later. For versions 23.04.x through 23.04.2, update to version 23.04.3 or later. For versions 23.10.x through 23.10.0, update to version 23.10.1 or later. For versions 24.04.x through 24.04.1, update to version 24.04.2 or later. For versions 24.10.x through 24.09.x, update to version 24.10.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-45756

Affected Products

Centreon-Open-Tickets

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-45756 · Security Note
• https://github.com/centreon/centreon/release · Note
• https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-45756-centreon-open-tickets-high-severity-4064 · Note
• https://twitter.com/CVEnew/status/1861101110292791603 · Twitter Post