CVE-2014-3829 displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) se...
HighCVSS 10.0
EPSS 80.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| merethis centreon | = 2.5.1 | No fix listed |
| merethis centreon enterprise server | = 2.2 | No fix listed |
References
- 20141016 Multiple unauthenticated SQL injections and unauthenticated remote command injection in Centreon <= 2.5.2 and Centreon Enterprise Server <= 2.2|3.0 exploit mailing-list
- VU#298796 third-party-advisory us-government-resource
- documentation.centreon.com
- github.com