CVEvulnerability
CVE-2018-11589
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-06-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
Affected configurations
• centreon centreon 3.4.6
• centreon centreon web 2.8.23
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html Release Notes, Vendor Advisory
- https://github.com/centreon/centreon/pull/6250 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6251 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6255 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6256 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6257 Patch, Third Party Advisory
- https://github.com/centreon/centreon/releases Third Party Advisory
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html Release Notes, Vendor Advisory
- https://github.com/centreon/centreon/pull/6250 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6251 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6255 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6256 Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/6257 Patch, Third Party Advisory
- https://github.com/centreon/centreon/releases Third Party Advisory