← Vulnerability feed

Vulnerability record · CVE-2019-17647 · published 5 March 2020

CVE-2019-17647: Centreon sql injection vulnerability

Centreon · Centreon

An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter.

9.8 CVSS 3.1 Critical EPSS 1.8% · top 22.5% CWE-89 · SQL injection
9.8CVSS 3.1 base score, v2 7.5
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8 Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30 Release NotesVendor Advisory
https://github.com/centreon/centreon/pull/8063 Third Party Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8 Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html Release NotesVendor Advisory
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30 Release NotesVendor Advisory
https://github.com/centreon/centreon/pull/8063 Third Party Advisory

Track CVE-2019-17647 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-3827Centreon vulnerabilityA vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of …EPSS 0.83%9.8CVE-2021-37558Centreon sql injection vulnerabilityA SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to exec…EPSS 2.1%9.8CVE-2018-21024Centreon unrestricted file upload vulnerabilitylicenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.EPSS 2.2%9.8CVE-2019-16194Centreon sql injection vulnerabilitySQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOn…EPSS 1.6%9.8CVE-2018-19281Centreon sql injection vulnerabilityCentreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.EPSS 1.8%9.8CVE-2018-11587Centreon code injection vulnerabilityThere is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.ph…EPSS 4.2%9.8CVE-2018-11589Centreon sql injection vulnerabilityMultiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the i…EPSS 2.1%8.8CVE-2022-42424Centreon poller broker config SQL injection privilege escalationCentreon fails to validate a user-supplied string before building SQL queries when handling requests to modify poller broker configuration. An authen…EPSS 76%analysed

Source: NIST National Vulnerability Database (record CVE-2019-17647), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.