Advisories · Technology
Centreon Infra Monitoring.
Every CVE that names Centreon Infra Monitoring among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
- Centreon Infra Monitoring
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
An unauthenticated user is able to introduce SQL Injection using the Awie export module
- Centreon Infra Monitoring
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated configuration import allows administrative account creation using AWIE component
- Centreon Infra Monitoring
- Authentication bypass
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the Hosts configuration parameters page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Information disclosure on Administration parameters API endpoint
- Centreon Infra Monitoring
- Broken access control
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
RCE via the backup feature available only to user with high privilege
- Centreon Infra Monitoring
- Command injection
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the Hostgroups configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the Notification rules configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
A user with elevated privileges can inject XSS in the Services Meta-services configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 8.4 High
CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON
- Centreon Infra Monitoring
- Broken access control
- CVSS 7.7 High
A user with low privileges can inject XSS in the Monitoring Recurrent downtimes page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the ACL Action access configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the Hosts templates configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the ACL Resource Access configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the SNMP traps group configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page
- Centreon Infra Monitoring
- Cross-site scripting (XSS)
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
RCE via the poller reload feature available only to user with high privilege
- Centreon Infra Monitoring
- Command injection
- CVSS 6.8 Medium
XSS found in the HTTP loader widget
- Centreon Infra Monitoring
- Cross-site scripting (XSS)