CVSS: 9.0EPSS: 70%CPEs: 1EXPL: 1CVE-2020-9463
https://notcve.org/view.php?id=CVE-2020-9463
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request. Centreon versión 19.10, permite a usuarios autentificados remotos ejecutar comandos arbitrarios del Sistema Operativo por medio de metacaracteres de shell en el campo server_ip en los datos JSON en una petición de api/internal.php?object=centreon_configuration_remote. • https://code610.blogspot.com/2020/02/postauth-rce-in-centreon-1910.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-20327
https://notcve.org/view.php?id=CVE-2019-20327
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid executable allowing execution of Perl scripts with root privileges.) Unos permisos no seguros en cwrapper_perl en Centreon Infrastructure Monitoring Software versiones hasta 19.10, permiten a atacantes locales alcanzar privilegios. (cwrapper_perl es un ejecutable setuid que permite la ejecución de scripts Perl con privilegios root). • https://gist.github.com/Diefunction/9237f46b8659a65ab08de8ec9c258139 https://www.centreon.com/en • CWE-732: Incorrect Permission Assignment for Critical Resource •