Vulnerability Description
A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. This allows one to inject Linux commands directly.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Centreon | Centreon Web | >= 2.8.1, < 2.8.30 |
Related Weaknesses (CWE)
References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease NotesThird Party Advisory
- https://github.com/centreon/centreon/pull/8023Third Party Advisory
- https://www.certilience.fr/2019/08/CVE-2019-15298-vulnerabilit%C3%A9-centreon-coNot Applicable
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease NotesThird Party Advisory
- https://github.com/centreon/centreon/pull/8023Third Party Advisory
- https://www.certilience.fr/2019/08/CVE-2019-15298-vulnerabilit%C3%A9-centreon-coNot Applicable
FAQ
What is CVE-2019-15298?
CVE-2019-15298 is a vulnerability with a CVSS score of 8.8 (HIGH). A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the ...
How severe is CVE-2019-15298?
CVE-2019-15298 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-15298?
Check the references section above for vendor advisories and patch information. Affected products include: Centreon Centreon Web.