Vulnerability Details CVE-2018-11589
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 38.2%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
- https://github.com/centreon/centreon/pull/6250
- https://github.com/centreon/centreon/pull/6251
- https://github.com/centreon/centreon/pull/6255
- https://github.com/centreon/centreon/pull/6256
- https://github.com/centreon/centreon/pull/6257
- https://github.com/centreon/centreon/releases
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
- https://github.com/centreon/centreon/pull/6250
- https://github.com/centreon/centreon/pull/6251
- https://github.com/centreon/centreon/pull/6255
- https://github.com/centreon/centreon/pull/6256
- https://github.com/centreon/centreon/pull/6257
- https://github.com/centreon/centreon/releases
Products affected by CVE-2018-11589
-
cpe:2.3:a:centreon:centreon:3.4.6
-
cpe:2.3:a:centreon:centreon_web:2.8.23