Vulnerability Description
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Centreon | Centreon Web | >= 2.8.1, < 2.8.30 |
Related Weaknesses (CWE)
References
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease Notes
- https://github.com/centreon/centreon/pull/8008PatchThird Party Advisory
- https://github.com/centreon/centreon/pull/8009PatchThird Party Advisory
- https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sqNot Applicable
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease Notes
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreoRelease Notes
- https://github.com/centreon/centreon/pull/8008PatchThird Party Advisory
- https://github.com/centreon/centreon/pull/8009PatchThird Party Advisory
- https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sqNot Applicable
FAQ
What is CVE-2019-15300?
CVE-2019-15300 is a vulnerability with a CVSS score of 8.8 (HIGH). A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly ...
How severe is CVE-2019-15300?
CVE-2019-15300 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-15300?
Check the references section above for vendor advisories and patch information. Affected products include: Centreon Centreon Web.