CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-40043
https://notcve.org/view.php?id=CVE-2022-40043
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. Una comprobación insuficiente de entradas no confiables en DevTools en Google Chrome en Chrome OS versiones anteriores a 105.0.5195.125, permitía a un atacante que convencía a un usuario de instalar una extensión maliciosa omitir las restricciones de navegación por medio de una página HTML diseñada. • https://github.com/centreon/centreon/releases https://www.hakaioffensivesecurity.com/centreon-sqli-and-xss-vulnerability • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2022-36194 – Centreon 22.04.0 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2022-36194
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter. Centreon versión 22.04.0, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) desde la función Pollers ) Broker Configuration al añadir una carga útil diseñada en el parámetro name Centreon version 22.04.0 suffers from a persistent cross site scripting vulnerability. • http://packetstormsecurity.com/files/168149/Centreon-22.04.0-Cross-Site-Scripting.html https://github.com/amdsyad/poc-dump/blob/main/Stored%20XSS%20in%20name%20parameter%20in%20Centreon%20version%2022.04.0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34871 – Centreon Poller Resource SQL Injection Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-34871
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of poller resources. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. • https://docs.centreon.com/docs/21.10/releases/centreon-core https://www.zerodayinitiative.com/advisories/ZDI-22-953 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34872 – Centreon Virtual Metrics SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-34872
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of Virtual Metrics. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. • https://docs.centreon.com/docs/21.10/releases/centreon-core https://www.zerodayinitiative.com/advisories/ZDI-22-954 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 1CVE-2020-22345
https://notcve.org/view.php?id=CVE-2020-22345
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter. El archivo /graphStatus/displayServiceStatus.php en Centreon versión 19.10.8, permite a atacantes remotos ejecutar comandos arbitrarios del Sistema Operativo por medio de metacaracteres shell en el parámetro RRDdatabase_path. • https://engindemirbilek.github.io/centreon-19.10-rce https://github.com/centreon/centreon/pull/8467#event-3163627607 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •