CVE-2019-16194 SQL injection in Centreon
SQL injection in Centreon allows attackers to manipulate database queries via the svc_id parameter, potentially exposing or altering monitoring data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16194?
CVE-2019-16194 is a critical SQL injection vulnerability in Centreon Centreon, published on 25 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
Weakness: CWE-89
Which versions are affected by CVE-2019-16194?
4 open source packages ship an affected version, including centreon/centreon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
centreon/centreon Packagist | All versions | 18.10.8 |
centreon/centreon Packagist | All versions | 18.10.8 |
centreon/centreon Packagist | From 19.0.0 | 19.04.5 |
centreon/centreon Packagist | From 19.0.0 | 19.04.5 |
Products include Centreon Centreon.
How do I fix CVE-2019-16194?
Upgrade centreon/centreon to a fixed version for your release line: 18.10.8 or 19.04.5.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-16194 being exploited?
There is no known exploitation of CVE-2019-16194 in the wild and no public exploit code.
Other vulnerabilities in Centreon Centreon
Sources
Also known as GHSA-wgjx-hm34-qgf7.