CVE-2020-22345

EUVD-2021-1951
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
centreoncentreon
19.10.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://engindemirbilek.github.io/centreon-19.10-rce
https://github.com/centreon/centreon/pull/8467#event-3163627607
https://engindemirbilek.github.io/centreon-19.10-rce
https://github.com/centreon/centreon/pull/8467#event-3163627607