CVE-2019-17646: 
Centreon vulnerability analysis and mitigation

An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService (NVD, Security Tracker).

The vulnerability allows unauthenticated access to sensitive information through a direct API endpoint. Specifically, the issue exists in the api/external.php file when making requests with the parameters object=centreon_metric and action=listByService. This vulnerability was fixed in Centreon versions 18.10.8, 19.04.5, and 19.10.2 by implementing proper access controls (Centreon Docs).

The vulnerability exposes sensitive monitoring metrics and service information to unauthenticated users, potentially revealing internal system details and configuration that could be used by attackers to plan further attacks (NVD).

The recommended mitigation is to upgrade to Centreon version 18.10.8, 19.04.5, or 19.10.2 or later which includes fixes for this vulnerability. The fix implements proper authentication checks for API access (Centreon Docs).