CVE-2024-39842: 
Centreon vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Centreon 24.04.2 (CVE-2024-39842) that affects the user massive changes functionality. The vulnerability was reported by Trend Micro and was disclosed on September 17, 2024. This security flaw affects Centreon Web installations and impacts versions prior to 24.04.6, 23.10.16, 23.04.21, and 22.10.24 (Centreon Security).

The vulnerability is classified as a SQL injection flaw that exists within the updateAccessGroupLinks function. The issue stems from improper validation of user-supplied strings before they are used to construct SQL queries. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with low attack complexity (ZDI Advisory).

If successfully exploited, this vulnerability allows an authenticated attacker with high privileges to execute arbitrary SQL commands via user massive changes inputs. The impact affects the confidentiality, integrity, and availability of the system, with potential for data exposure, modification, or service disruption (ZDI Advisory).

Centreon has released security updates to address this vulnerability. Organizations are advised to upgrade to the following fixed versions: Centreon Web 24.04.6, Centreon Web 23.10.16, Centreon Web 23.04.21, or Centreon Web 22.10.24. These versions include cumulative fixes from prior updates (Centreon Security).