CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34872 – Centreon Virtual Metrics SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-34872
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of Virtual Metrics. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. • https://docs.centreon.com/docs/21.10/releases/centreon-core https://www.zerodayinitiative.com/advisories/ZDI-22-954 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 1CVE-2020-22345
https://notcve.org/view.php?id=CVE-2020-22345
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter. El archivo /graphStatus/displayServiceStatus.php en Centreon versión 19.10.8, permite a atacantes remotos ejecutar comandos arbitrarios del Sistema Operativo por medio de metacaracteres shell en el parámetro RRDdatabase_path. • https://engindemirbilek.github.io/centreon-19.10-rce https://github.com/centreon/centreon/pull/8467#event-3163627607 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-37558
https://notcve.org/view.php?id=CVE-2021-37558
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the host_name and service_description parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/configKnowledge/proxy/proxy.php. Una vulnerabilidad de inyección SQL en un script de MediaWiki en Centreon versiones anteriores a 20.04.14, 20.10.8 y 21.04.2, permite a atacantes remotos no autenticados ejecutar comandos SQL arbitrarios por medio de los parámetros host_name y service_description. La vulnerabilidad puede ser explotada sólo cuando se configura una URL válida de la Base de Conocimientos en la página de configuración de la Base de Conocimientos y apunta a una instancia de MediaWiki. • https://github.com/centreon/centreon/pull/9796 https://www.synacktiv.com/sites/default/files/2021-07/Centreon_Multiple_vulnerabilities_0.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 1CVE-2021-37557
https://notcve.org/view.php?id=CVE-2021-37557
A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/views/graphs/generateGraphs/generateImage.php index parameter. Una vulnerabilidad de inyección SQL en la generación de imágenes en Centreon versiones anteriores a 20.04.14, 20.10.8 y 21.04.2, permite a atacantes remotos autenticados (pero con pocos privilegios) ejecutar comandos SQL arbitrarios por medio del parámetro index en el archivo include/views/graphs/generateGraphs/generateImage.php • https://github.com/centreon/centreon/pull/9787 https://www.synacktiv.com/sites/default/files/2021-07/Centreon_Multiple_vulnerabilities_0.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 1CVE-2021-37556
https://notcve.org/view.php?id=CVE-2021-37556
A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/reporting/dashboard/csvExport/csv_HostGroupLogs.php start and end parameters. Una vulnerabilidad de inyección SQL en la exportación de informes en Centreon versiones anteriores a 20.04.14, 20.10.8 y 21.04.2, permite a atacantes remotos autenticados (pero con pocos privilegios) ejecutar comandos SQL arbitrarios por medio de los parámetros start y end en el archivo include/reporting/dashboard/csvExport/csv_HostGroupLogs.php • https://github.com/centreon/centreon/pull/9781 https://www.synacktiv.com/sites/default/files/2021-07/Centreon_Multiple_vulnerabilities_0.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •