CVE-2019-17642: CSRF
First published: Thu Mar 05 2020(Updated: )
An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscovery plugin.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Centreon Centreon | >=18.0.0<18.10.8 | |
| Centreon Centreon | >=19.04.0<19.04.2 | |
| Centreon Centreon | >=19.10.0<19.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html
- https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-17642.
What is the severity level of CVE-2019-17642?
The severity level of CVE-2019-17642 is high.
What software versions are affected by CVE-2019-17642?
Centreon versions between 18.0.0 and 18.10.8, 19.04.0 and 19.04.2, and 19.10.0 and 19.10.1 are affected by CVE-2019-17642.
How can this vulnerability be exploited?
This vulnerability can be exploited through CSRF attacks with resultant remote command execution via shell metacharacters in a POST request to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscovery plugin.
Where can I find more information about CVE-2019-17642?
You can find more information about CVE-2019-17642 in the following documentation links: [link1](https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html), [link2](https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html), and [link3](https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html).
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- vendor/centreon
- canonical/centreon centreon
- version/centreon centreon/18.0.0
- version/centreon centreon/19.04.0
- version/centreon centreon/19.10.0