CVE-2019-13024: Command Injection
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shellexec without sanitizing it, allowing one to execute system arbitrary commands).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-13024?
CVE-2019-13024 is a vulnerability in Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 that allows an attacker to execute arbitrary system commands.
How severe is CVE-2019-13024?
CVE-2019-13024 has a severity rating of 8.8, which is considered critical.
How can an attacker exploit CVE-2019-13024?
An attacker can exploit CVE-2019-13024 by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert an arbitrary command into the database and execute it.
Which versions of Centreon are affected by CVE-2019-13024?
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 are affected by CVE-2019-13024.
Are there any references available for CVE-2019-13024?
Yes, you can find references for CVE-2019-13024 at the following links: [Packet Storm Security](http://packetstormsecurity.com/files/153504/Centreon-19.04-Remote-Code-Execution.html), [Centreon Documentation - Centreon 18.10.6](https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.6.html), [Centreon Documentation - Centreon 19.04.3](https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04/centreon-19.04.3.html).