Design/Logic Flaw

2020-05-2104:15:00

PRIOn knowledge base

www.prio-n.com

9 High

AI Score

Confidence

High

0.193 Low

EPSS

Percentile

96.3%

JSON

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.

CPENameOperatorVersion
centreonge19.04.0
centreonlt19.04.15

CPE	Name	Operator	Version
	centreon	ge	19.04.0
	centreon	lt	19.04.15

References

engindemirbilek.github.io/centreon-19.10-rce

github.com/centreon/centreon/compare/19.04.13...19.04.15

github.com/centreon/centreon/pull/8467

github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.html