Command Injection in Centreon
High severity
GitHub Reviewed
Published
Jun 22, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
May 21, 2020
Reviewed
May 20, 2021
Published to the GitHub Advisory Database
Jun 22, 2021
Last updated
Feb 1, 2023
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
References