CVE-2020-22345: OS Command Injection in Centreon
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabasepath parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/centreon/centreonto a version that resolves this vulnerability.Fixed in 20.04.0
Event History
Frequently Asked Questions
What is CVE-2020-22345?
CVE-2020-22345 is a vulnerability in Centreon 19.10.8 that allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.
What is the severity of CVE-2020-22345?
The severity of CVE-2020-22345 is critical with a CVSS score of 8.8.
How does CVE-2020-22345 affect Centreon?
CVE-2020-22345 affects Centreon 19.10.8.
How can remote attackers exploit CVE-2020-22345?
Remote attackers can exploit CVE-2020-22345 by sending malicious input containing shell metacharacters in the RRDdatabase_path parameter.
Is there a fix available for CVE-2020-22345?
Yes, a fix for CVE-2020-22345 is available. Please refer to the provided references for more information.