TI-2022-03507 Aliases CVE-2022-3827 GHSA-j5wx-jvw3-j363

centreon Contact Groups Form formContactGroup.php sql injection

MEDIUM 44CWE-707Published 2022-11-02 · Updated 2025-04-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql injection. The attack can be initiated remotely. The name of the patch is 293b10628f7d9f83c6c82c78cf637cbe9b907369. It is recommended to apply a patch to fix this issue. VDB-212794 is the identifier assigned to this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01018 63rd percentileScored 2026-11-07

Fix Fixed centreon/centreon (Packagist): 22.10.0-beta1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
unspecified	centreon	all versions	—	No fix listed	CNA
—	centreon/centreon (Packagist)	before 22.10.0-beta1	22.10.0-beta1	Patch available	GHSA-j5wx-jvw3-j363

centreon Vendorunspecified Affected all versions Fixed in — No fix listed CNA
centreon/centreon (Packagist) Vendor— Affected before 22.10.0-beta1 Fixed in 22.10.0-beta1 Patch available GHSA-j5wx-jvw3-j363

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:centreon:centreon::::::::	before 22.10.0	Vulnerable	Centreon

cpe:2.3:a:centreon:centreon:*:*:*:*:*:*:*:* Versions before 22.10.0 Vulnerable ·Centreon

Remediation

Fix · GHSA-j5wx-jvw3-j363 centreon/centreon (Packagist) Fixed in 22.10.0-beta1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-3827
2026-10-03 Alias added: GHSA-j5wx-jvw3-j363

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-3827

Other 1

https://github.com/centreon/centreon

TI-2022-19661 SQL injection in Centreon CVSS 3.1HIGH 8.8
TI-2022-20634 SQL injection in Centreon CVSS 3.1HIGH 8.8
TI-2022-20632 SQL injection in Centreon CVSS 3.1HIGH 8.8
TI-2022-20630 SQL injection in Centreon CVSS 3.1HIGH 8.8
TI-2022-20629 SQL injection in Centreon CVSS 3.1HIGH 8.8
TI-2019-09757 Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows… CVSS 3.0HIGH 8.8

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences