VulnerabilityModified
CVE-2019-15300
An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php.
HIGH 8.8EPSS 2.01%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.01% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- centreon/centreon web
- Source
- cve@mitre.org
References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.htmlRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.htmlRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.htmlRelease Notes
- https://github.com/centreon/centreon/pull/8008Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/8009Patch, Third Party Advisory
- https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injectionNot Applicable
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.htmlRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.htmlRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.htmlRelease Notes
- https://github.com/centreon/centreon/pull/8008Patch, Third Party Advisory
- https://github.com/centreon/centreon/pull/8009Patch, Third Party Advisory
- https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injectionNot Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.