CVE-2019-15300: A problem was found in Centreon Web through 19.04.3

High severity · published Nov 27, 2019

CVE-2019-15300

A problem was found in Centreon Web through 19.04.3

8.8

CVSS

EPSS

On KEV

Description

A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.0% · higher than 81% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Centreon Web · Centreon

2.8.1 before 2.8.30; 19.04.0 before 19.04.5; 19.10.0 before 19.10.2 · source: NVD

Affected product

Centreon Web

Centreon

All Centreon Web CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-15300

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-15300

Release Notes

https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html

Release Notes

https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html

Release Notes

https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html

Patch

https://github.com/centreon/centreon/pull/8008

Patch

https://github.com/centreon/centreon/pull/8009

Not Applicable

https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injection