Authentication flaw

2020-02-2413:15:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication.

CPENameOperatorVersion
centreon_weble19.04.3

CPE	Name	Operator	Version
	centreon_web	le	19.04.3

References

documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html

documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html

github.com/centreon/centreon/pull/8072