CVEvulnerability
CVE-2019-17642
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-03-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352, CWE-78
Description
An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscovery plugin.
Affected configurations
• centreon centreon (>= 18.0.0 < 18.10.8)
• centreon centreon (>= 19.04.0 < 19.04.2)
• centreon centreon (>= 19.10.0 < 19.10.1)
Related
References
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html Release Notes, Vendor Advisory
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html Release Notes, Vendor Advisory