CVEブラウザに戻る

CVE-2014-3829

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1270%

EPSS Percentile18.79th

Published2014年10月23日

Last Modified2026年5月6日

Vulnerability Description

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.

Affected Platforms (CPE)

📦

Merethis

Centreon

= 2.5.1

📦

Merethis

Centreon Enterprise Server

= 2.2

References & Advisories

🔗 http://seclists.org/fulldisclosure/2014/Oct/78

🔗 http://www.kb.cert.org/vuls/id/298796

🔗 https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html

🔗 https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

🔗 http://seclists.org/fulldisclosure/2014/Oct/78

🔗 http://www.kb.cert.org/vuls/id/298796

🔗 https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html

🔗 https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

関連する脆弱性情報

CVE-2014-382810.0

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow re...

CVE-2009-436810.0

Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) tra...

CVE-2018-115899.8

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in ...

CVE-2018-115879.8

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in cen...