SB2019070118 - Multiple vulnerabilities in Centreon

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019070118

SB2019070118 - Multiple vulnerabilities in Centreon

Published: July 1, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019070118
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2019-17501)

The vulnerability allows a remote authenticated user to execute arbitrary code.

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.


2) Command Injection (CVE-ID: CVE-2019-13024)

The vulnerability allows a remote authenticated user to execute arbitrary code.

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).


Remediation

Install update from vendor's website.

References