CVE-2024-45755: 
Centreon vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Centreon centreon-dsm-server affecting multiple versions (24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22.10.x before 22.10.2). The vulnerability was discovered on August 30, 2024, and publicly disclosed on November 22, 2024. The issue exists in the form used to configure Centreon DSM slots (Centreon Watch, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The issue specifically affects the form functionality used to configure Centreon DSM slots, allowing SQL injection attacks (Centreon Watch).

The vulnerability could potentially lead to unauthorized access to the database, data manipulation, or information disclosure. However, the impact is somewhat limited as exploitation requires authentication and high-privileged access to the system (NVD).

Fixes have been provided for all supported versions. Organizations are recommended to update to the following versions: Centreon DSM 24.10.0, Centreon DSM 24.04.3, Centreon DSM 23.10.1, Centreon DSM 23.04.3, or Centreon DSM 22.10.2. These versions include cumulative fixes from prior updates (Centreon Watch).

The vulnerability was responsibly reported by security researchers Matthew Taylor, Ludovic Tavernier and Rémi Millerand from Algosecure (Centreon Watch).