CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2022-36194 – Centreon 22.04.0 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2022-36194
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter. Centreon versión 22.04.0, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) desde la función Pollers ) Broker Configuration al añadir una carga útil diseñada en el parámetro name Centreon version 22.04.0 suffers from a persistent cross site scripting vulnerability. • http://packetstormsecurity.com/files/168149/Centreon-22.04.0-Cross-Site-Scripting.html https://github.com/amdsyad/poc-dump/blob/main/Stored%20XSS%20in%20name%20parameter%20in%20Centreon%20version%2022.04.0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34871 – Centreon Poller Resource SQL Injection Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-34871
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of poller resources. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. • https://docs.centreon.com/docs/21.10/releases/centreon-core https://www.zerodayinitiative.com/advisories/ZDI-22-953 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34872 – Centreon Virtual Metrics SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-34872
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of Virtual Metrics. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. • https://docs.centreon.com/docs/21.10/releases/centreon-core https://www.zerodayinitiative.com/advisories/ZDI-22-954 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 1CVE-2020-22345
https://notcve.org/view.php?id=CVE-2020-22345
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter. El archivo /graphStatus/displayServiceStatus.php en Centreon versión 19.10.8, permite a atacantes remotos ejecutar comandos arbitrarios del Sistema Operativo por medio de metacaracteres shell en el parámetro RRDdatabase_path. • https://engindemirbilek.github.io/centreon-19.10-rce https://github.com/centreon/centreon/pull/8467#event-3163627607 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-37558
https://notcve.org/view.php?id=CVE-2021-37558
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the host_name and service_description parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/configKnowledge/proxy/proxy.php. Una vulnerabilidad de inyección SQL en un script de MediaWiki en Centreon versiones anteriores a 20.04.14, 20.10.8 y 21.04.2, permite a atacantes remotos no autenticados ejecutar comandos SQL arbitrarios por medio de los parámetros host_name y service_description. La vulnerabilidad puede ser explotada sólo cuando se configura una URL válida de la Base de Conocimientos en la página de configuración de la Base de Conocimientos y apunta a una instancia de MediaWiki. • https://github.com/centreon/centreon/pull/9796 https://www.synacktiv.com/sites/default/files/2021-07/Centreon_Multiple_vulnerabilities_0.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •