Critical severity · published Jun 25, 2018
CVE-2018-11589
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php,…
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Centreon · Centreon
3.4.6 · source: NVD
CW
Centreon Web · Centreon
2.8.23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11589
Release Notes
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
Patch
https://github.com/centreon/centreon/pull/6250
Patch
https://github.com/centreon/centreon/pull/6251
Patch
https://github.com/centreon/centreon/pull/6255
Patch
https://github.com/centreon/centreon/pull/6256
Patch
https://github.com/centreon/centreon/pull/6257
More from Centreon
9.8
CVE-2024-32501
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x…
9.8
CVE-2022-3827
centreon Contact Groups Form formContactGroup.php sql injection
9.8
CVE-2021-37558
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via…
9.8
CVE-2019-17647
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2
9.8
CVE-2018-21024
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request