CVE-2018-11589 json
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.…
published 2018-06-25 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-3614
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
Patch / fix
- github.com/centreon/centreon#6250 pull request
- github.com/centreon/centreon#6257 pull request
- github.com/centreon/centreon#6251 pull request
- github.com/centreon/centreon#6256 pull request
- github.com/centreon/centreon#6255 pull request
Exploit prediction
2.11% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/centreon/centreon/pull/6250
patch, third-party-advisory
-
github.com
/centreon/centreon/pull/6257
patch, third-party-advisory
-
github.com
/centreon/centreon/pull/6251
patch, third-party-advisory
-
github.com
/centreon/centreon/pull/6256
patch, third-party-advisory
-
github.com
/centreon/centreon/pull/6255
patch, third-party-advisory
-
documentation.centreon.com
/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
release-notes, vendor-advisory
-
github.com
/centreon/centreon/releases
third-party-advisory
Sources
- CVE List CVE-2018-11589
- NVD CVE-2018-11589
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.