CVE-2024-55573

critical · 9.1

An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to create virtual metrics.

9.1

CVSS

1.1%

EPSS (exploit prob.)

65th

EPSS percentile

2025-01-23

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
centreon	centreon_web	>= 23.04.0, < 23.04.24
centreon	centreon_web	>= 23.10.0, < 23.10.19
centreon	centreon_web	>= 24.04.0, < 24.04.9
centreon	centreon_web	>= 24.10.0, < 24.10.3

Check a specific version with /api/v1/cve/match.

References

https://github.com/centreon/centreon/releases
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55573-centreon-web-critical-severity-4264

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-55573