Centreon Infra Monitoring OS Command Injection Vulnerability

A vulnerability allowing OS command injection has been identified in Centreon Infra Monitoring versions 24.10.0 prior to 24.10.13, 24.04.0 prior to 24.04.18, and 23.10.0 prior to 23.10.28. The issue arises in the poller reload setup within the configuration modules, where a user with high privileges can append custom instructions to the poller reload command, potentially leading to unauthorized command execution on the server.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the server where Centreon is running.

Remediation

Users are advised to update Centreon Web on the Central Server to version 24.10.13, 24.04.18, or 23.10.28, all of which include cumulative fixes from prior updates.