Vulnerability Details CVE-2014-3829
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.862
EPSS Ranking 99.4%
CVSS Severity
CVSS v2 Score 10.0
References
- http://seclists.org/fulldisclosure/2014/Oct/78
- http://www.kb.cert.org/vuls/id/298796
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
- https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
- http://seclists.org/fulldisclosure/2014/Oct/78
- http://www.kb.cert.org/vuls/id/298796
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
- https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
Products affected by CVE-2014-3829
-
cpe:2.3:a:merethis:centreon:2.5.1
-
cpe:2.3:a:merethis:centreon_enterprise_server:2.2