CVE-2021-37558: SQL Injection
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the hostname and servicedescription parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/configKnowledge/proxy/proxy.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Centreon MediaWiki (class/centreon-knowledge/ProceduresProxy.class.php, include/configuration/configKnowledge/proxy/proxy.php)to a version that resolves this vulnerability.Fixed in 20.04.14 - Upgrade
Upgrade
Centreon MediaWiki (class/centreon-knowledge/ProceduresProxy.class.php, include/configuration/configKnowledge/proxy/proxy.php)to a version that resolves this vulnerability.Fixed in 20.10.8 - Upgrade
Upgrade
Centreon MediaWiki (class/centreon-knowledge/ProceduresProxy.class.php, include/configuration/configKnowledge/proxy/proxy.php)to a version that resolves this vulnerability.Fixed in 21.04.2
Event History
Frequently Asked Questions
What is CVE-2021-37558?
CVE-2021-37558 is a SQL injection vulnerability in a MediaWiki script in Centreon before versions 20.04.14, 20.10.8, and 21.04.2.
What is the severity of CVE-2021-37558?
CVE-2021-37558 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2021-37558?
An attacker can exploit CVE-2021-37558 by sending specially crafted host_name and service_description parameters to execute arbitrary SQL commands.
Which software versions are affected by CVE-2021-37558?
CVE-2021-37558 affects Centreon versions before 20.04.14, 20.10.8, and 21.04.2.
Where can I find more information about CVE-2021-37558?
You can find more information about CVE-2021-37558 at the following references: [GitHub](https://github.com/centreon/centreon/pull/9796) and [Synacktiv](https://www.synacktiv.com/sites/default/files/2021-07/Centreon_Multiple_vulnerabilities_0.pdf).