CVE-2021-37556: SQL Injection

Q: What is CVE-2021-37556?

CVE-2021-37556 is a SQL injection vulnerability in the reporting export feature in Centreon before versions 20.04.14, 20.10.8, and 21.04.2.

Q: How does CVE-2021-37556 affect Centreon?

CVE-2021-37556 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the start and end parameters in csv_HostGroupLogs.php.

Q: What is the severity of CVE-2021-37556?

CVE-2021-37556 has a severity rating of 8.8 (high).

Q: How can I fix CVE-2021-37556?

To fix CVE-2021-37556, users should update their Centreon installation to version 20.04.14, 20.10.8, or 21.04.2 or later.

Q: What is CWE-89?

CWE-89 is a category for SQL injection vulnerabilities, which is the type of vulnerability present in CVE-2021-37556.

Published Aug 3, 2021

Updated

A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/reporting/dashboard/csvExport/csvHostGroupLogs.php start and end parameters.

Affected Software

3 affected components

Centreon Centreon<20.04.14

Centreon Centreon>=20.10.0<20.10.8

Centreon Centreon>=21.04.0<21.04.2

Remediation

Patch Available

https://github.com/centreon/centreon/pull/9781

Event History

Aug 3, 2021

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-37556?

CVE-2021-37556 is a SQL injection vulnerability in the reporting export feature in Centreon before versions 20.04.14, 20.10.8, and 21.04.2.

How does CVE-2021-37556 affect Centreon?

CVE-2021-37556 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the start and end parameters in csv_HostGroupLogs.php.

What is the severity of CVE-2021-37556?