CVE-2025-3767: 
Centreon vulnerability analysis and mitigation

CVE-2025-3767 is a SQL Injection vulnerability discovered in Centreon BAM (Boolean KPi Listing modules). The vulnerability was disclosed on April 22, 2025, affecting multiple versions of Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, and from 23.04 before 23.04.10. The vulnerability is only accessible to authenticated users with high privileges (NVD, Centreon Watch).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Boolean KPI listing functionality. It has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is identified as CWE-89, indicating SQL injection type (NVD).

The SQL injection vulnerability could allow authenticated users with high privileges to potentially access, modify, or delete unauthorized data in the database. The CVSS score of 7.2 indicates high potential impact on confidentiality, integrity, and availability of the system (NVD).

Centreon has released patches for all affected versions. Users are recommended to update to the following versions: centreon-bam-server 24.10.1, centreon-bam-server 24.04.5, centreon-bam-server 23.10.10, or centreon-bam-server 23.04.10. These versions include cumulative fixes from prior updates (Centreon Watch).

The vulnerability was initially reported by Matthew Taylor, Ludovic Tavernier and Remi Millerand from Algosecure on August 30, 2024. The CVE ID was changed from CVE-2024-46924 to CVE-2025-3767 during the disclosure process (Centreon Watch).