CVE-2019-15299

EUVD-2019-6306
An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
Affected Products (NVD)
VendorProductVersion
centreoncentreon_web
𝑥
≤ 19.04.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html
https://github.com/centreon/centreon/pull/8072
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html
https://github.com/centreon/centreon/pull/8072