Command Injection in Centreon

2021-06-2215:23:33

Google

osv.dev

0.193 Low

EPSS

Percentile

96.3%

JSON

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.

CPENameOperatorVersion
centreon/centreoneq18.10.7
centreon/centreoneq19.04.4
centreon/centreoneq2.99.3
centreon/centreoneq19.04.11
centreon/centreoneq19.04.3
centreon/centreoneq19.04.2
centreon/centreoneq19.04.10
centreon/centreoneq2.7.3
centreon/centreoneq18.10.9
centreon/centreoneq19.04.9

Name	Operator	Version
centreon/centreon	eq	18.10.7
centreon/centreon	eq	19.04.4
centreon/centreon	eq	2.99.3
centreon/centreon	eq	19.04.11
centreon/centreon	eq	19.04.3
centreon/centreon	eq	19.04.2
centreon/centreon	eq	19.04.10
centreon/centreon	eq	2.7.3
centreon/centreon	eq	18.10.9
centreon/centreon	eq	19.04.9