CVE-2019-19699 Privilege escalation in n/a
Authenticated administrators can escalate privileges to root by exploiting a misconfigured poller restart command that executes as root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19699?
CVE-2019-19699 is a high-severity vulnerability in Centreon Centreon, published on 6 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability, someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.
Weakness: CWE-269
Which versions are affected by CVE-2019-19699?
It affects 1 product.
Products include Centreon Centreon.
How do I fix CVE-2019-19699?
No fix has been published for CVE-2019-19699 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19699 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-19699 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in Centreon Centreon
Sources
Also known as GHSA-wwvc-xq5p-g468.