CVE-2018-19312: Centreon SQL Injection
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/centreon/centreonto a version that resolves this vulnerability.Fixed in 2.8.24 - Upgrade
Upgrade
composer/centreon/centreonto a version that resolves this vulnerability.Fixed in 18.10.0 - Upgrade
Upgrade
Centreonto a version that resolves this vulnerability.Fixed in 18.10.0 - Upgrade
Upgrade
Centreon webto a version that resolves this vulnerability.Fixed in 2.8.24
Event History
Frequently Asked Questions
What is CVE-2018-19312?
CVE-2018-19312 is a SQL Injection vulnerability in Centreon 3.4.x that allows an attacker to inject malicious SQL code through the searchVM parameter.
How severe is CVE-2018-19312?
CVE-2018-19312 has a severity score of 8.8, which is considered high.
What software versions are affected by CVE-2018-19312?
Centreon 3.4.0 to 3.4.9, Centreon web 2.8.0 to 2.8.24, and Centreon 18.0.0 to 18.10.0 are affected by CVE-2018-19312.
How can I fix CVE-2018-19312?
To fix CVE-2018-19312, update Centreon to version 18.10.0 or later, Centreon web to version 2.8.24 or later, or apply the necessary patches.
Where can I find more information about CVE-2018-19312?
You can find more information about CVE-2018-19312 on the NIST National Vulnerability Database and Centreon's documentation.