GHSA-c8qc-cp8v-prpx

Centreon RCE Vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-11587

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	centreon/centreon	3.4.6	no fix listed
Packagist	centreon/centreon	>= 2.8.23, < 2.8.24	2.8.24

Details

As written in the advisory (Markdown source, shown as plain text).

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-11587 advisory
https://github.com/centreon/centreon-archived/pull/6263 web
https://github.com/centreon/centreon-archived/pull/6263/commits/fb438e6aaf133cc5f9d25130653ba8fdc6ecf51f web
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html web