CVE-2014-3828

Опубликовано: 23 окт. 2014

Источник: nvd

CVSS2: 10

EPSS Высокий

Описание

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.

Ссылки

http://seclists.org/fulldisclosure/2014/Oct/78
Exploit
http://www.kb.cert.org/vuls/id/298796
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/70648
Exploit
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
http://seclists.org/fulldisclosure/2014/Oct/78
Exploit
http://www.kb.cert.org/vuls/id/298796
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/70648
Exploit
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:merethis:centreon:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:merethis:centreon_enterprise_server:2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.78588

Высокий

10 Critical

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-rpfp-gv2p-xqp5

github

больше 3 лет назад