Centreon 2.6.x < 2.6.5 Multiple Vulnerabilities

medium Nessus Plugin ID 87053

Language:

Synopsis

The remote web server contains a PHP application that is affected by multiple vulnerabilities.

Description

According to its version number, the Centreon application hosted on the remote web server is version 2.6.x prior to 2.6.5. It is, therefore, affected by multiple vulnerabilities :

- A cross-site request forgery (XSRF) vulnerability exists in the main.php script. A remote attacker can exploit this to perform administrative actions by convincing a user to follow a link to a malicious website.

- A flaw exists in the main.php script due to improper sanitization of user-supplied input to the POST 'persistent' parameter. An authenticated, remote attacker can exploit this to execute arbitrary shell commands.

- A cross-site scripting vulnerability exists in the main.php script due to improper sanitization of user-supplied input to the 'img_comment' POST parameter.
An authenticated, remote attacker can exploit this, via a crafted request, to execute arbitrary script code in a user's browser session.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Centreon version 2.6.5 or later.

Plugin Details

Severity: Medium

ID: 87053

File Name: centreon_265.nasl

Version: 1.10

Type: remote

Family: CGI abuses

Published: 11/24/2015

Updated: 4/11/2022

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:centreon:centreon, cpe:/a:merethis:centreon

Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/Centreon

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/21/2015

Vulnerability Publication Date: 9/26/2015

Detections

Analytics