Skip to main content

Security Bulletins

Stay informed with the latest Centreon security bulletins to safeguard your infrastructure effectively.

30 Topics
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2025-24813 - Centreon Map all version - CRITICAL severitySecurity Bulletin

Publication date: June 24, 2025Components: centreon-map-engine or centreon-map-legacy (on map server) Description: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was

230
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2022-46337 - Centreon MBI - Critical severitySecurity Bulletin

Publication date: June 10, 2025Component: centreon-bi-engineFeature: CBIS Engine Description:Apache derby has been upgrade to the 10.17.1.0 on the 24.04, 24.10 and develop branches in January 2024.But this was not not the case on the 23.10 and 23.04 version. Reference: CVE-2022-46337CVSS:  9.8Severity: CRITICAL Status: Fixes have been provided for all supported versions and it is recommended to update Centreon MBI server:Centreon MBI Engine 23.10.12 Centreon MBI Engine 23.04.23These versions include cumulative fixes from prior updates. Reporter: N/ASubmission: April 09, 2025Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

1530
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2025-4649 - Centreon Web - Medium severitysecurity bulletin

Publication date: March 14, 2025Component: centreon-webFeature:Event logs page Description: ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. Reference: CVE-2025-4649CVSS:  4.9 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Severity: MEDIUM Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central:Centreon 24.10.4 Centreon 24.04.10 Centreon 23.10.21 Centreon 23.04.26These versions include cumulative fixes from prior updates. Reporter: Benoit PouletSubmission: Feb 03, 2025Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

600
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Updated - CVE-2023-28447 - Centreon - High severitysecurity bulletin

Publication date: May 12, 2025Components: centreon-web, centreon-open-tickets & centreon-mbi-server.Feature: Open Tickets and Reporting (MBI) Update: Last March, we published a security bulletin advising you to update your Centreon central server. However, we did not make all module packages available. If you are using Centreon version 23.04.x ​​or 23.10.x, and if you use the ticket creation (Open Tickets) or reports generation (Centreon MBI) features, you must update your Centreon central server as well as these modules. Description: Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Upgrade to either version 3.1.48.1 Reference: CVE-2024-

1550
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2023-28447 - Centreon - High severitysecurity bulletin

Publication date: March 12, 2025Update: May, 12, 2025Components: centreon-web and all modules.Feature: All legacy pages Description: Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Upgrade to either version 3.1.48.1 Reference: CVE-2024-55573CVSS:  7.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central, Centreon Map and Centreon MBI servers:Centreon 23.10.x (centreon-web-23.10.22 and modules). Centreon 23.04.x (centreon-web-23.04.27 and modules)These versions include cumulative fixes from prior updates.Centreon 24.10.x and

2942
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Centreon Map - Critical severitysecurity bulletin

  Publication date: Mai 12, 2025Component: centreon-map-engine On Centreon Map server.Feature: Graphical views (maps) Description: Upgraded spring security web dependency to version 6.2.8. Reference: N/ACVSS:  9.1Severity: CRITICAL Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Map server:Centreon Map 24.10.5 Centreon Map 24.04.11 Centreon Map 23.10.19 Centreon Map 23.04.23These versions include cumulative fixes from prior updates. Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

2000
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2022-46337 - Centreon MBI - Critical severitysecurity bulletin

Publication date: May 12, 2025Components: centreon-mbi-server on Centreon central server Description: Upgraded Apache Derby to version 10.17.1.0.Reference: CVE-2022-46337CVSS: 9.8Severity: Critical Status: Vulnerability has been already fixed for Centreon MBI 24.04.0 and 24.10.0 versions. Fixes have been backported for following versions and it is recommended to update Centreon central server:Centreon MBI 24.10.22 Centreon MBI 23.04.23These versions include cumulative fixes from prior updates. Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

1560
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-46924/CVE-2025-3767 - Centreon BAM - High severitysecurity bulletin

Publication date: March 10th, 2025Component: centreon-bam-server (on central server)Feature: Boolean KPI listing Description: SQLi in the listing of Boolean KPI, only accessible to authenticated users with high privilege access. Reference: CVE-2025-3767 (previously CVE-2024-46924)CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:centreon-bam-server 24.10.1 centreon-bam-server 24.04.5 centreon-bam-server 23.10.10 centreon-bam-server 23.04.10These versions include cumulative fixes from prior updates. Reporter: Matthew Taylor, Ludovic Tavernier and Remi Millerand from AlgosecureSubmission: August 30, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

3521
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-55571/CVE-2025-3872 - Centreon Web - High severitySecurity bulletin

Publication date: March 17, 2025Component: centreon-web.Feature: User / Contact form Description: User with high privileges is able to become administrator by intercepting a request and altering the payload Reference: CVE-2025-3872  (replace CVE-2024-55571)CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.4 Centreon Web 24.04.10 Centreon Web 23.10.20 Centreon Web 23.04.25These versions include cumulative fixes from prior updates. Reporter: Floerer for YesWeHackSubmission: November 25, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

5040
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-35226 - Centreon - High severitysecurity bulletin

Publication date: March 12, 2025Component: centreon-web and all modules.Feature: All legacy pages Description: smarty/smarty is vulnerable to code injection. The vulnerability is due to insufficient validation of file names used in the `extends-tag`. This allows attackers to inject PHP code by choosing a malicious file name for an `extends-tag`. Reference: CVE-2024-35226CVSS:  7.3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central, Centreon Map and Centreon MBI servers:Centreon 24.10.x Centreon 24.04.x Centreon 23.10.x Centreon 23.04.xThese versions include cumulative fixes from prior updates. Reporter: N/ASubmission: November 28, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

1690
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2025-4647/CVE-2024-55574 - Centreon Web - High severitysecurity bulletin

Publication date: March 12, 2025Component: centreon-web (on central server).Feature: Media upload Description: A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG. Reference: CVE-2025-4647 (replace CVE-2024-55574)CVSS:  8.4 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.5 Centreon Web 24.04.11 Centreon Web 23.10.22 Centreon Web 23.04.27These versions include cumulative fixes from prior updates. Reporter: SpawnZii working with YesWeHackSubmission: November 27, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

2570
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2025-4648/CVE-2024-55575 - Centreon Web - High severitysecurity bulletin

Publication date: March 12, 2025Component: centreon-web (on central server).Feature: Media upload Description: A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. Reference: CVE-2024-55575CVSS:  8.4 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.5 Centreon Web 24.04.11 Centreon Web 23.10.22 Centreon Web 23.04.27These versions include cumulative fixes from prior updates. Reporter: SpawnZii working with YesWeHackSubmission: November 27, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

2660
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2025-4646/CVE-2024-55572 - Centreon Web - HIGH severitysecurity bulletin

  Publication date: March 10th, 2025Component: centreon-web (on central server).Feature: API Token Description: On the API token page a user with high privilege is able to create an API token for an admin owner and copy this token's value. Reference:  CVE-2025-4646 (replace CVE-2024-55572)CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions having this feature and it is recommended to update Centreon Central server:Centreon Web 24.10.4 Centreon Web 24.04.10These versions include cumulative fixes from prior updates. Reporter: Floerer from YesWeHackSubmission: November 25, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

2720
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Centreon Map - Critical severitysecurity bulletin

Publication date: February 17, 2025Components: centreon-map-engine (on map server), centreon-map-web-client (on central server) Description: Security fixes have been madeRemoved commons-logging (including Log4j). CVSS 9.8 Upgraded Apache Tomcat version. CVSS 9.8 Upgraded DOM purify. CVSS 8.3  Reference: N/ASeverity: Critical Status: Fixes have been provided for all supported versions and it is recommended to update both Centreon Central server and Centreon Map server:Centreon Map 24.10.3 Centreon Map 24.04.9 Centreon Map Legacy 24.04.9 Centreon Map 23.10.17 Centreon Map Legacy 23.10.17 Centreon Map 23.04.22 Centreon Map Legacy 23.04.22These versions include cumulative fixes from prior updates. Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

1915
C
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Centreon Web - medium severitySecurity bulletin

Publication date: February 10, 2025Component: centreon-web (on central server).Feature: Event Logs page Description: ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. Reference: To Be DefinedCVSS:  4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NSeverity: Medium Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.4 Centreon Web 24.04.10 Centreon Web 23.10.21 Centreon Web 23.04.26These versions include cumulative fixes from prior updates. Reporter: Benoit PouletSubmission: February 3rd, 2025Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

2440
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-55573 - Centreon Web - Critical severitysecurity bulletin

Publication date: January 3rd, 2025Component: centreon-web (on central server).Feature: Virtual metrics settings Description: SQLi in the form used to create virtual metrics in centreon-web, only accessible to authenticated users with high privilege access and rights to create a virtual metric. Reference: CVE-2024-55573CVSS:  9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.3 Centreon Web 24.04.9 Centreon Web 23.10.19 Centreon Web 23.04.24These versions include cumulative fixes from prior updates. Reporter: SpawnZii for YesWeHackSubmission: November 25, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

9201
dagabard
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-53923 - Centreon Web - Critical severitysecurity bulletin

Publication date: January 3rd, 2025Component: centreon-web (on central server).Feature: Upload of medias Description: SQLi in the form to upload media in centreon-web, only accessible to authenticated users with high privilege access (access to administration pages). Reference: CVE-2024-53923CVSS:  9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Severity: CRITICAL Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.3 Centreon Web 24.04.9 Centreon Web 23.10.19 Centreon Web 23.04.24These versions include cumulative fixes from prior updates. Reporter: SpawnZii for YesWeHackSubmission: November 21, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

4670
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-45757 - Centreon BAM - High severitysecurity bulletin

Publication date: December 3rd, 2024Component: centreon-bam-server (on central server).Feature: Manage user settings Description: SQLi in the user settings form, only accessible to authenticated users with high privilege access. Reference: CVE-2024-45757CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon BAM 24.10.0 Centreon BAM 24.04.4 Centreon BAM 23.10.9 Centreon BAM 23.04.9These versions include cumulative fixes from prior updates. Reporter: Matthew Taylor, Ludovic Tavernier and Rémi Millerand from AlgosecureSubmission: Aug 30, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date. 

5510
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-45755 - Centreon DSM - High severitysecurity bulletin

Publication date: November 22, 2024Component: centreon-dsm-server (on central server).Feature: Manage DSM slots Description: SQLi in the form to configure Centreon DSM slots, only accessible to authenticated users with high privilege access. Reference: CVE-2024-45755CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon DSM 24.10.0 Centreon DSM 24.04.3 Centreon DSM 23.10.1 Centreon DSM 23.04.3 Centreon DSM 22.10.2These versions include cumulative fixes from prior updates. Reporter: Matthew Taylor, Ludovic Tavernier and Rémi Millerand from AlgosecureSubmission: Aug 30, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date.

6680
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-45756 - Centreon Open Tickets - High severitysecurity bulletin

Publication date: November 22, 2024Component: centreon-open-tickets (on central server).Feature: Open Tickets into ITSM tool from Centreon Description: SQLi in the form to create a ticket, only accessible to authenticated users with high privilege access. Reference: CVE-2024-45756CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Open Tickets 24.10.0 Centreon Open Tickets 24.04.2 Centreon Open Tickets 23.10.1 Centreon Open Tickets 23.04.4 Centreon Open Tickets 22.10.4These versions include cumulative fixes from prior updates.👉 Important note: to ensure you do not lose any customization that might have been done to your OpenTicket provider, please make sure to:Take a backup of these folders: /usr/share/centreon/www/modules/centreon-open-tickets and /usr/share/centreon/www/widgets/open-tickets Apply the patch Copy the backed up register.php f

4810
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-47863 - Centreon WEB - Medium severitySecurity bulletin

Publication date: November 22, 2024Component: centreon-web (on central server).Feature: Monitoring configuration logs Description: A stored XSS was found in the user configuration contact name field.Details : A script can be stored in the contact name field to be reflected in the adminstration logs. These two pages are only accessible to authenticated users with high privilege access. Reference: CVE-2024-47863CVSS:  6.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N Severity: MEDIUM Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon Web 24.10.0 Centreon Web 24.04.8 Centreon Web 23.10.18 Centreon Web 23.04.23 Centreon Web 22.10.26These versions include cumulative fixes from prior updates. Reporter: Mounir Aarab from NTT BelgiumSubmission: Sep 14, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring

6570
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
CVE-2024-45754 - Centreon MBI - High severitySecurity Bulletin

Publication date: October 10, 2024Component: centreon-bi-server (on central server).Feature: Reporting jobs configuration. Description: A SQL injection vulnerability in the listing of configured reporting jobs.Details : SQLi in configuration pages, only accessible to authenticated users with high privilege access. Reference: CVE-2024-45754CVSS:  7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity: HIGH Status: Fixes have been provided for all supported versions and it is recommended to update Centreon Central server:Centreon BI Server 24.04.3 Centreon BI Server 23.10.8 Centreon BI Server 23.04.11 Centreon BI Server 22.10.11These versions include cumulative fixes from prior updates. Reporter: Matthew Taylor, Ludovic Tavernier and Rémi Millerand from AlgosecureSubmission: Jul 31, 2024 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secur

7240
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Security bulletin for Centreon Websecurity bulletin

Security fixed in Centreon Web Submission: June 26, 2024Publication date: October 1, 2024Severity: MEDIUM Component: centreon-webFixes have been provided for all supported versions and it is recommended to update Centreon Web:Centreon Web 24.04.7 Centreon Web 23.10.17 Centreon Web 23.04.22 Centreon Web 22.10.24These versions include cumulative fixes from prior updates. CVE-2022-31160Reporter: Orange BVPNImpact:  (CVSS + Path)  6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Description: Vulnerabilities where present into previous jQuery UI dependency (prior to 1.13.2).Reference: CVE-2022-31160 Stay ahead of potential threats by subscribing to the Security Bulletin section. You’ll receive instant notifications whenever a new bulletin is published, ensuring your infrastructure remains secure and up to date. 

4490
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Security bulletin for Centreon Websecurity bulletin

Security fixed in Centreon Web Submission: June 21, 2024Publication date: September 17, 2024Severity: HIGH Feature: Edition of contacts / usersComponent: centreon-webFixes have been provided for all supported versions and it is recommended to update Centreon Web:Centreon Web 24.04.6 Centreon Web 23.10.16 Centreon Web 23.04.21 Centreon Web 22.10.24These versions include cumulative fixes from prior updates. CVE-2024-39842 - SQLi in contacts form, only accessible to authenticated users with high privilege access.Reporter: Trend MicroImpact:  (CVSS + Path)  7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Description: A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs.Reference: CVE-2024-39842 CVE-2024-39843 - SQLi in contacts form, only accessible to authenticated users with high privilege access.Reporter: Trend MicroImpact:  (CVSS + Path)  7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/

9570
Laurent
Centreonian
Laurent
Centreonian
LaurentCentreonian
published in Latest Security Bulletins
Security bulletin for Centreon Websecurity bulletin

An audit has identified security vulnerabilities in Centreon Web.Centreon is unaware of situations where these could have been exploited.If an instance of Centreon Web is exposed on Internet, these vulnerabilities have a high likelihood of being exploited and have a severe impact if exploited which results in a high risk. Type of vulnerability :CVE-2024-32501 : SQL Injection, in updateServiceHostCVE-2024-33852 : SQL Injection in Downtime componentCVE-2024-33853 : SQL Injection in Timeperiod componentCVE-2024-33854 : SQL Injection in Graph Template componentCVE-2024-5725 : SQL Injection in Metric Image componentCVE-2024-39841 : SQL Injection via service configuration It is therefore highly recommended to apply the provided product updates as early as possible. Version impactedAll Centreon on-premise platform versions are vulnerable. Applying the fixFixes have been provided for all supported versions and it is recommended to update Centreon Web: Centreon Web 24.04.3 Centreon Web 23.10.

23400
Laurent
Centreonian

Badge winners

  • First Reply
    clement85has earned the badge First Reply
  • First Topic Created
    DimDimhas earned the badge First Topic Created
  • Five Replies
    CAR-CENTREONhas earned the badge Five Replies
  • First Reply
    FabienLhas earned the badge First Reply
  • First Topic Created
    clement85has earned the badge First Topic Created
Show all badges
Terms & ConditionsCookie settings