« Volver al listado

CVE-2024-33852

Estado: AnalizadaCrítica (9.1)—

A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Centreon — Centreon WEB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33852",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33852",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-23T16:36:41.271254Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*"
          ],
          "vendor": "centreon",
          "product": "centreon_web",
          "versions": [
            {
              "status": "affected",
              "version": "24.04.0",
              "lessThan": "24.04.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "23.10.0",
              "lessThan": "23.10.13",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "23.04.0",
              "lessThan": "23.04.19",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "22.10.0",
              "lessThan": "22.10.23",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-23T17:15:06.570",
  "references": [
    {
      "url": "https://github.com/centreon/centreon/releases",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de inyección SQL en el componente Tiempo de inactividad en Centreon Web 24.04.x anterior a 24.04.3, 23.10.x anterior a 23.10.13, 23.04.x anterior a 23.04.19 y 22.10.x anterior a 22.10.23."
    }
  ],
  "lastModified": "2026-06-17T07:32:25.860",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E8C8537-415D-4063-969C-C1DAFC745917",
              "versionEndExcluding": "22.10.23",
              "versionStartIncluding": "22.10.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D1AC871-9AB8-4D93-B9F2-2E884F249C00",
              "versionEndExcluding": "23.04.19",
              "versionStartIncluding": "23.04.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F04FF72A-5B47-45AD-8B66-81F02956127A",
              "versionEndExcluding": "23.10.13",
              "versionStartIncluding": "23.10.0"
            },
            {
              "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "512A0A4A-38C5-4EF5-B971-308C56E12E50",
              "versionEndExcluding": "24.04.3",
              "versionStartIncluding": "24.04.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}