Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x…
Priority MEDIUM 54CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
Why it matters now
EPSS 0.27002 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed centreon/centreon (Packagist): 18.10.8, 19.04.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | centreon/centreon (Packagist) | before 18.10.8 | 18.10.8 | Patch available | GHSA-4f26-v6fr-9hmp |
| — | centreon/centreon (Packagist) | 19.0.0 to before 19.04.5 | 19.04.5 | Patch available | GHSA-4f26-v6fr-9hmp |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- centreon/centreon (Packagist) Vendor— Affected before 18.10.8 Fixed in 18.10.8 Patch available GHSA-4f26-v6fr-9hmp
- centreon/centreon (Packagist) Vendor— Affected 19.0.0 to before 19.04.5 Fixed in 19.04.5 Patch available GHSA-4f26-v6fr-9hmp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* | before 2.8.30; 18.10.0 to before 18.10.8; 19.04.0 to before 19.04.5; 19.10.0 to before 19.10.2 | Vulnerable | Centreon |
- cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* Versions before 2.8.30; 18.10.0 to before 18.10.8; 19.04.0 to before 19.04.5; 19.10.0 to before 19.10.2 Vulnerable ·Centreon
Remediation
- Fix · GHSA-4f26-v6fr-9hmp centreon/centreon (Packagist) Fixed in 18.10.8 Advisory →
- Fix · GHSA-4f26-v6fr-9hmp centreon/centreon (Packagist) Fixed in 19.04.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16405
- 2026-10-03 Alias added: GHSA-4f26-v6fr-9hmp
References
Exploit 2
Patch 3
Advisory 5
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html
- https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-16405
More Centreon Web vulnerabilities
- TI-2024-00588 SQL injection in Centreon CVSS 3.0HIGH 8.8
- TI-2024-15236 SQL injection in Centreon CVSS 3.1HIGH 7.2
- TI-2024-05319 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2024-05317 SQL injection in Centreon CVSS 3.1HIGH 8.8
- TI-2024-21388 A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon… CVSS 3.1CRITICAL 9.8
- TI-2024-15239 SQL injection in Centreon CVSS 3.0HIGH 7.2
Sources
- CVE-2019-16405 · CVE Program
- CVE-2019-16405 · NVD
- FIRST EPSS
- GHSA-4f26-v6fr-9hmp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences