Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2024-23119: Centreon lets attackers run code via graph template
CVE-2024-23119 · published 2 years ago
Summary
The Centreon monitoring system can be tricked into running unwanted programs when someone supplies malicious data to the graph‑template feature. An attacker who can log in can use this flaw to make the Centreon service execute their code, potentially compromising your network. Apply the latest Centreon updates and limit access to the web interface to trusted users.
What to do
- Update centreon centreon to version 22.10.15.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | centreon | centreon |
< 22.10.15 Fix: upgrade to 22.10.15
|
| – | centreon | centreon_web |
< 22.04.19 >= 22.10.2, < 22.10.17 >= 23.04.0, < 23.04.13 >= 23.10.0, < 23.10.5 cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* |
Original advisory text
Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability
Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the insertGraphTemplate function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22339.
The specific flaw exists within the insertGraphTemplate function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22339.
References
- https://www.zerodayinitiative.com/advisories/ZDI-24-113
- https://github.com/centreon/centreon/pull/2464
- https://github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a...
- https://github.com/advisories/GHSA-626r-cj47-p49g
- https://www.zerodayinitiative.com/advisories/ZDI-24-113/ Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23119... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-23119 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published1 Apr 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta