Back to CVE Browser

CVE-2014-3829

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1270%

EPSS Percentile18.79th

PublishedOct 23, 2014

Last ModifiedMay 6, 2026

Vulnerability Description

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.

Affected Platforms (CPE)

📦

Merethis

Centreon

= 2.5.1

📦

Merethis

Centreon Enterprise Server

= 2.2

References & Advisories

🔗 http://seclists.org/fulldisclosure/2014/Oct/78

🔗 http://www.kb.cert.org/vuls/id/298796

🔗 https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html

🔗 https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

🔗 http://seclists.org/fulldisclosure/2014/Oct/78

🔗 http://www.kb.cert.org/vuls/id/298796

🔗 https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html

🔗 https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

Related Vulnerabilities

CVE-2014-382810.0

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow re...

CVE-2009-436810.0

Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) tra...

CVE-2018-115899.8

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in ...

CVE-2018-115879.8

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in cen...