CVE-2021-37558

CRITICAL

Centreon < 20.04.14 - Unauthenticated SQL Injection via host_name and service_description Parameters

Title source: llm
STIX 2.1

Description

A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the host_name and service_description parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/configKnowledge/proxy/proxy.php.

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/centreon/centreon/pull/9796

Scores

CVSS v3 9.8
EPSS 0.0211
EPSS Percentile 79.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
centreon/centreon < 20.04.14
Published Aug 03, 2021
Tracked Since Feb 18, 2026