Centreon 跨站请求伪造漏洞

漏洞介绍

Centreon（Merethis Centreon）是法国Centreon公司的一套开源的系统监控工具 。该产品主要提供对网络、系统和应用程序等资源的监控功能。

Centreon 18.10.8之前版本、19.10.1之前版本和19.04.2之前版本中存在安全漏洞。攻击者可通过向centreon-autodiscovery-server/views/scan/ajax/call.php页面发送带有shell元字符的POST请求利用该漏洞执行命令。

漏洞补丁

目前厂商已发布升级了Centreon 跨站请求伪造漏洞的补丁，Centreon 跨站请求伪造漏洞的补丁获取链接：

https://documentation.centreon.com/docs/centreon-auto-discovery/zh-CN/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html

https://documentation.centreon.com/docs/centreon-auto-discovery/zh-CN/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html

https://documentation.centreon.com/docs/centreon-auto-discovery/zh-CN/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html

参考网址

来源:CONFIRM

链接：https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html

来源:CONFIRM

链接：https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html

来源:CONFIRM

链接：https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html

来源:MISC

链接：https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html

受影响实体

暂无

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-211