CVE-2024-33853

Vulnerability

A SQL injection vulnerability exists in the Timeperiod component of Centreon Web. Affected versions include 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23 [1]. The vulnerability is present in the on-premise platform; Centreon Cloud platforms are not affected [1].

Exploitation

An attacker must have authenticated access to the Centreon Web interface. The SQL injection occurs within the Timeperiod component, likely through unsanitized user input passed to a database query. No additional privileges or network position beyond standard web access are required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the Centreon database. This can lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the monitoring platform [1].

Mitigation

Centreon has released fixed versions: Centreon Web 24.04.3, 23.10.13, 23.04.19, and 22.10.23 [1]. Users should update to the latest supported version. For unsupported versions, upgrading to 24.04 is recommended. No workarounds are provided [1].