Skip to main content

Security fixed in Centreon Web

 

Submission: June 21, 2024

Publication date: September 17, 2024

Severity: HIGH

 

Feature: Edition of contacts / users

Component: centreon-web

Fixes have been provided for all supported versions and it is recommended to update Centreon Web:

These versions include cumulative fixes from prior updates.

 

CVE-2024-39842 - SQLi in contacts form, only accessible to authenticated users with high privilege access.

Reporter: Trend Micro

Impact:  (CVSS + Path)  7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

Description: A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs.

ReferenceCVE-2024-39842

 

CVE-2024-39843 - SQLi in contacts form, only accessible to authenticated users with high privilege access.

Reporter: Trend Micro

Impact:  (CVSS + Path)  7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

Description: A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs.

ReferenceCVE-2024-39843

Be the first to reply!

Reply