CVE-2018-11589: SQL Injection
First published: Mon Jun 25 2018(Updated: )
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Centreon Centreon | =3.4.6 | |
| Centreon Centreon Web | =2.8.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
- https://github.com/centreon/centreon/pull/6250
- https://github.com/centreon/centreon/pull/6251
- https://github.com/centreon/centreon/pull/6255
- https://github.com/centreon/centreon/pull/6256
- https://github.com/centreon/centreon/pull/6257
- https://github.com/centreon/centreon/releases
Frequently Asked Questions
What is CVE-2018-11589?
CVE-2018-11589 is a vulnerability in Centreon 3.4.6 including Centreon Web 2.8.23 that allows SQL injection attacks.
How severe is CVE-2018-11589?
CVE-2018-11589 is classified as critical with a severity score of 9.8.
What software versions are affected by CVE-2018-11589?
Centreon 3.4.6 and Centreon Web 2.8.23 are affected by CVE-2018-11589.
How can attacks exploit CVE-2018-11589?
Attacks can exploit CVE-2018-11589 through the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_ parameter in various components.
Are there any fixes or patches available for CVE-2018-11589?
Yes, fixes for CVE-2018-11589 can be found in the official Centreon release notes and GitHub pull requests.
- collector/nvd-index
- agent/author
- agent/severity
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/references
- agent/description
- agent/remedy
- agent/type
- agent/weakness
- agent/tags
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/centreon
- canonical/centreon centreon
- version/centreon centreon/3.4.6
- canonical/centreon centreon web
- version/centreon centreon web/2.8.23