Lucene search

[email protected]CVE-2019-15300

HistoryNov 27, 2019 - 2:15 p.m.

CVE-2019-15300

2019-11-2714:15:11

CWE-89

[email protected]

web.nvd.nist.gov

cve-2019-15300

sql injection

centreon web

authentication

security vulnerability

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.9%

JSON

A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.

Affected configurations

NVD

Node

centreoncentreon_webRange2.8.1–2.8.30

centreoncentreon_webRange19.04.0–19.04.5

centreoncentreon_webRange19.10.0–19.10.2

CPENameOperatorVersion
centreon:centreon_webcentreon centreon weblt2.8.30
centreon:centreon_webcentreon centreon weblt19.04.5
centreon:centreon_webcentreon centreon weblt19.10.2

CPE	Name	Operator	Version
centreon:centreon_web	centreon centreon web	lt	2.8.30
centreon:centreon_web	centreon centreon web	lt	19.04.5
centreon:centreon_web	centreon centreon web	lt	19.10.2

References

documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html

documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html

documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html

github.com/centreon/centreon/pull/8008

github.com/centreon/centreon/pull/8009

www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injection

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.9%

JSON

Related for CVE-2019-15300

prion1 cvelist1 nvd1