Description
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injection ↗
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html ↗
- https://github.com/centreon/centreon/pull/8008 ↗
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html ↗
- https://github.com/centreon/centreon/pull/8009 ↗
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html ↗