GitHub Advisoryadvisory · Packagist

GHSA-7rg4-266c-jqw6 Predictable CSRF tokens in centreon/centreon

MEDIUM Published 2021-06-08 Modified 2022-06-29 Official page ↗
Aliases
CVE-2021-28055
Ecosystem
Packagist
Packages
centreon/centreon
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-330, CWE-352
Reviewed
2021-05-07

Affected packages

• Packagist centreon/centreon: >= 20.10.0, < 20.10.7 → fixed in 20.10.7 • Packagist centreon/centreon: >= 20.04.0, < 20.04.13 → fixed in 20.04.13 • Packagist centreon/centreon: >= 19.10.0, < 19.10.23 → fixed in 19.10.23 • Packagist centreon/centreon: < 2.8.37 → fixed in 2.8.37

Description

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.

Related

Alias · CVE (1)

  • CVE-2021-28055 An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. vulnerability

Weakness · CWE (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-352 Cross-Site Request Forgery weakness

References