CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26804
https://notcve.org/view.php?id=CVE-2021-26804
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application. Los permisos no seguros en Centreon Web versiones 19.10.18, 20.04.8 y 20.10.2, permiten a atacantes remotos omitir la comprobación al cambiar cualquier extensión de archivo a ".gif" y luego cargándola en la sección de la aplicación "Administration/ Parameters/ Images" • https://medium.com/%40pedro.ferreira.phf/vulnerability-affecting-some-versions-of-centreon-2b34bd6dc621 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15299
https://notcve.org/view.php?id=CVE-2019-15299
An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication. Se detectó un problema en Centreon Web versiones hasta 19.04.3. Cuando un usuario cambia su contraseña sobre su página de perfil, el campo contact_autologin_key en la base de datos pasa a blanco cuando debería ser NULL. • https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html https://github.com/centreon/centreon/pull/8072 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 4%CPEs: 4EXPL: 0CVE-2019-15298
https://notcve.org/view.php?id=CVE-2019-15298
A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. • https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html https://github.com/centreon/centreon/pull/8023 https://www.certilience.fr/2019/08/CVE-2019-15298-vulnerabilit%C3%A9-centreon-command-injection • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-15300
https://notcve.org/view.php?id=CVE-2019-15300
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query. Se encontró un problema en Centreon Web versiones hasta la versión 19.04.3. Una inyección SQL autenticada está presente en la página include/Administration/parameters/ldap/xml/ldap_host.php. • https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html https://github.com/centreon/centreon/pull/8008 https://github.com/centreon/centreon/pull/8009 https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16406
https://notcve.org/view.php?id=CVE-2019-16406
Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse Centreon-autodisco executable file that is launched by cron. Centreon Web versión 19.04.4, presenta permisos débiles dentro de los archivos OVA (también se conoce como máquina virtual VMware) y OVF (también se conoce como máquina virtual VirtualBox), permitiendo a atacantes conseguir privilegios por medio de un archivo ejecutable Centreon-autodisco de tipo caballo de Troya que es iniciado por cron. • https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-10 https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-8 https://d • CWE-732: Incorrect Permission Assignment for Critical Resource •