PT-2025-3131 · Centreon · Centreon Web

Spawnzii · Published 2025-01-03 · Updated 2025-06-06 · CVE-2024-55573

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Centreon centreon-web versions 24.10.x prior to 24.10.3 Centreon centreon-web versions 24.04.x prior to 24.04.9 Centreon centreon-web versions 23.10.x prior to 23.10.19 Centreon centreon-web versions 23.04.x prior to 23.04.24

Description A user with high privileges is able to inject SQL into the form used to create virtual metrics. This issue allows an attacker with high privileges to perform SQL injection, potentially enabling privilege escalation.

Recommendations For Centreon centreon-web version 24.10.x prior to 24.10.3, update to version 24.10.3 or later. For Centreon centreon-web version 24.04.x prior to 24.04.9, update to version 24.04.9 or later. For Centreon centreon-web version 23.10.x prior to 23.10.19, update to version 23.10.19 or later. For Centreon centreon-web version 23.04.x prior to 23.04.24, update to version 23.04.24 or later. As a temporary workaround, consider restricting access to the form used to create virtual metrics until a patch is applied.

Fix

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-01461

CVE-2024-55573

Affected Products

Centreon Web

References · 24

• https://bdu.fstec.ru/vul/2025-01461 · Security Note
• https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55573-centreon-web-critical-severity-4264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55573 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55573 · Vendor Advisory
• https://github.com/centreon/centreon/releases · Note
• https://twitter.com/TMJIntel/status/1884276500481843344 · Twitter Post
• https://twitter.com/fridaysecurity/status/1884055934328348701 · Twitter Post
• https://t.me/netlas/324 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1884292988555211006 · Twitter Post
• https://twitter.com/Dinosn/status/1884104448911536429 · Twitter Post
• https://twitter.com/CveFindCom/status/1882556679625027658 · Twitter Post
• https://cyberalerts.io/vulnerability/CVE-2024-55573 · Note
• https://t.me/cvedetector/16245 · Telegram Post
• https://twitter.com/Netlas_io/status/1884144369030070626 · Twitter Post
• https://t.me/cvenotify/108447 · Telegram Post