CVE-2019-16405

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 27%

from disclosure to weapon0 days

Published on NVDNov 21

1st PoCOct 18

exploitation probability

27%top 2% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/TheCyberGeek/CVE-2019-16405.rb★ 9 cve_referencepacketstormsecurity.com/files/155999/Centreon-19.04-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/47948unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/155999/Centreon-19.04-Remote-Code-Execution.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html https://github.com/centreon/centreon/pull/7864 https://github.com/centreon/centreon/pull/7884 https://github.com/TheCyberGeek/CVE-2019-16405.rb https://thecybergeek.co.uk/cves/2019/09/17/CVE-2019-16405-06.html https://thecybergeek.co.uk/cves/2019/09/19/CVEs.html