Centreon Information Disclosure Vulnerability

Centreon Merethis Centreon is a set of open-source system monitoring tools from the French company Centreon. The product mainly provides monitoring functions for resources such as network, system and application programs. There is a security vulnerability in Centreon. An attacker can exploit this...

CVE-2019-17643

An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php...

CVE-2019-17644

An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php...

CVE-2019-17643

An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php...

CVE-2019-17644

An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php...

Design/Logic Flaw

An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php...

Design/Logic Flaw

An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php...

CVE-2019-17644

CVE-2019-17644 affects Centreon versions before 2.8-30, 18.10-8, 19.04-5, and 19.10-2. An unauthenticated direct request to include/configuration/configObject/host/refreshMacroAjax.php permits disclosure of sensitive information. Root cause is improper access control on the host macro refresh end...

CVE-2019-17644

An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php...

CVE-2019-17643

An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php...

CVE-2019-17643

Centreon versions affected include 2.8-30, 18.10-8, 19.04-5, and 19.10-2. The issue is an information disclosure where an unauthenticated direct request to include/monitoring/recurrentDowntime/GetXMLHost4Services.php leaks sensitive information. The CVE-2019-17643 entry documents that an unauthen...

CVE-2020-9463

Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the serverip field in JSON data in an api/internal.php?object=centreonconfigurationremote request...

CVE-2020-9463

Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the serverip field in JSON data in an api/internal.php?object=centreonconfigurationremote request...

CVE-2020-9463

Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the serverip field in JSON data in an api/internal.php?object=centreonconfigurationremote request...

Cross site request forgery (csrf)

Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the serverip field in JSON data in an api/internal.php?object=centreonconfigurationremote request...

CVE-2020-9463

Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the serverip field in JSON data in an api/internal.php?object=centreonconfigurationremote request...

CVE-2020-9463

CVE-2020-9463 affects Centreon 19.10. The vulnerability allows a remote authenticated user to execute arbitrary OS commands via shell metacharacters in the server_ip field of a JSON payload sent to api/internal.php?object=centreon_configuration_remote. Root cause is command injection through impr...

Authentication Bypass

centreon/centreon is vulnerable to authentication bypass. Changing a password on a profile page by a valid user causes the contactautologinkey value in database filed to be blank instead of NULL, allowing to partially bypass the authentication...

CVE-2019-15299

An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contactautologinkey field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication...

CVE-2019-15299

An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contactautologinkey field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication...