CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value…

published July 1, 2019

CVSS
—
EPSS
32%
Percentile
98.3
In the wild
Unconfirmed
What it is

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.31645 · 98.3th percentile
Published
2019-07-01T18:17Z
EPSS history
Timeline
  • 22 SEP 03:17Z
    EPSS moved 32% → 21%
    epss
  • 06 SEP 03:12Z
    EPSS moved 32% → 21%
    epss
  • 30 AUG 16:01Z
    EPSS moved 21% → 32%
    epss
  • 29 AUG 04:47Z
    EPSS moved 32% → 21%
    epss
  • 01 JUL 18:17Z
    Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value…
    cvelistv5