Lucene search

MitreCVE-2021-26804

HistoryMay 04, 2021 - 5:15 p.m.

CVE-2021-26804

2021-05-0417:15:07

CWE-276

mitre

web.nvd.nist.gov

cve-2021-26804

insecure permissions

centreon web

remote attack

validation bypass

file extension

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to “.gif”, then uploading it in the “Administration/ Parameters/ Images” section of the application.

Affected configurations

Nvd

Node

centreoncentreon_webMatch19.10.18

centreoncentreon_webMatch20.04.8

centreoncentreon_webMatch20.10.2

VendorProductVersionCPE
centreoncentreon_web19.10.18cpe:2.3:a:centreon:centreon_web:19.10.18:*:*:*:*:*:*:*
centreoncentreon_web20.04.8cpe:2.3:a:centreon:centreon_web:20.04.8:*:*:*:*:*:*:*
centreoncentreon_web20.10.2cpe:2.3:a:centreon:centreon_web:20.10.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
centreon	centreon_web	19.10.18	cpe:2.3:a:centreon:centreon_web:19.10.18:::::::*
centreon	centreon_web	20.04.8	cpe:2.3:a:centreon:centreon_web:20.04.8:::::::*
centreon	centreon_web	20.10.2	cpe:2.3:a:centreon:centreon_web:20.10.2:::::::*

References

medium.com/%40pedro.ferreira.phf/vulnerability-affecting-some-versions-of-centreon-2b34bd6dc621

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

Related for CVE-2021-26804