CVE-2018-19281 Centreon allows SNMP trap SQL Injection
Attackers can execute arbitrary SQL commands via SNMP traps in Centreon, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-19281?
CVE-2018-19281 is a critical SQL injection vulnerability in Centreon Centreon, published on 14 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
Weakness: CWE-89
Which versions are affected by CVE-2018-19281?
4 open source packages ship an affected version, including centreon/centreon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
centreon/centreon Packagist | From 18.0.0 | 18.10.0 |
centreon/centreon Packagist | From 18.0.0 | 18.10.0 |
centreon/centreon Packagist | From 2.8 | 2.8.27 |
centreon/centreon Packagist | From 2.8 | 2.8.27 |
Products include Centreon Centreon.
How do I fix CVE-2018-19281?
Upgrade centreon/centreon to a fixed version for your release line: 18.10.0 or 2.8.27.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-19281 being exploited?
There is no known exploitation of CVE-2018-19281 in the wild and no public exploit code.
Other vulnerabilities in Centreon Centreon
Sources
Also known as GHSA-w2xf-4gg9-87wr.