CVE-2019-17107

HIGH

Centreon Web < 2.8.27 - Authenticated OS Command Injection via minPlayCommand.php command_hostaddress Parameter

Title source: llm
STIX 2.1

Description

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.

References (3)

Core 3
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/centreon/centreon/pull/7099
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2019/10/08/1
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/09/2

Scores

CVSS v3 8.8
EPSS 0.0357
EPSS Percentile 87.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
centreon/centreon_web 2.8 - 2.8.27
Published Oct 08, 2019
Tracked Since Feb 18, 2026