NVD Vulnerability Detail

CVE-2019-17646

Summary	An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService.
Publication Date	March 6, 2020, 5:15 a.m.
Registration Date	Jan. 26, 2021, 11:40 a.m.
Last Update	Nov. 21, 2024, 1:32 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8	Release Notes Vendor Advisory
2	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8	Release Notes Vendor Advisory
3	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5	Release Notes Vendor Advisory
4	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5	Release Notes Vendor Advisory
5	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2	Release Notes Vendor Advisory
6	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2	Release Notes Vendor Advisory
7	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html	Release Notes Vendor Advisory
8	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html	Release Notes Vendor Advisory
9	https://github.com/centreon/centreon/pull/8021	Patch Third Party Advisory
10	https://github.com/centreon/centreon/pull/8021	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-425	リクエストの直接送信	https://cwe.mitre.org/data/definitions/425.html

JVN Vulnerability Information

Centreon における情報漏えいに関する脆弱性

Title	Centreon における情報漏えいに関する脆弱性
Summary	Centreon には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 28, 2019, midnight
Registration Date	March 16, 2020, 4:32 p.m.
Last Update	March 16, 2020, 4:32 p.m.

Affected System

Centreon

Centreon 18.10.8 未満

Centreon 19.04.5 未満

Centreon 19.10.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-17646	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17646
National Vulnerability Database (NVD)
2	CVE-2019-17646	https://nvd.nist.gov/vuln/detail/CVE-2019-17646

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Centreon
1	Centreon 19.10	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
2	Centreon Web 18.10.8	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8
3	Centreon Web 19.04.5	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5
4	Centreon Web 19.10.2	https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2

その他

No	Name	URL
関連文書
1	fix(acl): filter access to api using external entry point #8021	https://github.com/centreon/centreon/pull/8021

Change Log

No	Changed Details	Date of change
1	[2020年03月16日] 掲載	March 16, 2020, 4:32 p.m.