GHSA-5jxp-4x68-mhqc
Centreon SQL Injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | centreon/centreon | >= 18.0.0, < 18.10.0 | 18.10.0 |
| Packagist | centreon/centreon | >= 2.8.0, < 2.8.24 | 2.8.24 |
Details
As written in the advisory (Markdown source, shown as plain text).
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2018-19312
- https://github.com/centreon/centreon-archived/pull/6257
- https://github.com/centreon/centreon-archived/pull/6628
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
- http://www.roothc.com.br/1349-2