---
title: "Centreon centreon/centreon vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/centreon/centreon-centreon
type: product
description: "Centreon centreon/centreon has 27 published CVEs, 0 in CISA KEV and 11 with public exploits."
updated: 2024-04-01
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Centreon centreon/centreon vulnerabilities

Vendor: [Centreon](https://radicalnotion.ai/vendor/centreon)

- **Published CVEs:** 27
- **In CISA KEV:** 0
- **With a public exploit:** 11
- **With a patch:** 25
- **Average CVSS:** 7.7
- **First CVE:** 2015-07-14
- **Latest CVE:** 2024-04-01
- **Ecosystems:** composer

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 5 |
| High | 14 |
| Medium | 8 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 11 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5 |
| [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 2 |
| [CWE-330](https://radicalnotion.ai/cwe/cwe-330) | Use of Insufficiently Random Values | 1 |
| [CWE-565](https://radicalnotion.ai/cwe/cwe-565) | Reliance on Cookies without Validation and Integrity Checking | 1 |
| [CWE-707](https://radicalnotion.ai/cwe/cwe-707) | Improper Neutralization | 1 |
| [CWE-77](https://radicalnotion.ai/cwe/cwe-77) | Improper Neutralization of Special Elements used in a Command ('Command Injection') | 1 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 1 |
| 2016 | 0 |
| 2017 | 1 |
| 2018 | 6 |
| 2019 | 5 |
| 2020 | 2 |
| 2021 | 3 |
| 2022 | 3 |
| 2023 | 0 |
| 2024 | 6 |

## Affected versions (top 24 of 52)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 22.10.15 | range | 6 |
| 18.0.0 \<= v \< 18.10.0 | range | 4 |
| \< 18.10.8 | range | 2 |
| \< 2.8.28 | range | 2 |
| \< 21.04.16 | range | 2 |
| \<= 19.04.3 | range | 2 |
| 19.0.0 \<= v \< 19.04.5 | range | 2 |
| 21.10.0 \<= v \< 21.10.8 | range | 2 |
| \< 19.04.15 | range | 1 |
| \< 2.8.27 | range | 1 |
| \< 2.8.30 | range | 1 |
| \< 2.8.32 | range | 1 |
| 22.10.15 | patched | 6 |
| 18.10.0 | patched | 5 |
| 18.10.8 | patched | 2 |
| 19.04.5 | patched | 2 |
| 2.8.24 | patched | 2 |
| 2.8.27 | patched | 2 |
| 2.8.28 | patched | 2 |
| 20.10.7 | patched | 2 |
| 21.04.16 | patched | 2 |
| 21.10.8 | patched | 2 |
| 18.10.11 | patched | 1 |
| 19.04.10 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2024-23119 | Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability | high | 8.8 | No | No | Yes |
| CVE-2024-23118 | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability | high | 7.2 | No | No | Yes |
| CVE-2024-23117 | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability | high | 7.2 | No | No | Yes |
| CVE-2024-23116 | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability | high | 7.2 | No | No | Yes |
| CVE-2024-23115 | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability | high | 7.2 | No | No | Yes |
| CVE-2024-0637 | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability | high | 8.8 | No | No | Yes |
| CVE-2022-3827 | centreon Contact Groups Form formContactGroup.php sql injection | critical | 9.8 | No | No | Yes |
| CVE-2022-40044 | Centreon contains cross-site scripting vulnerability via esc\_name parameter | medium | 5.4 | No | Yes | Yes |
| CVE-2022-40043 | Centreon SQL Injection vulnerability via esc\_name parameter | high | 8.8 | No | Yes | Yes |
| CVE-2020-22345 | OS Command Injection in Centreon | high | 8.8 | No | Yes | Yes |
| CVE-2021-27676 | Cross-site scripting in Centreon | medium | 5.4 | No | No | Yes |
| CVE-2021-28055 | Predictable CSRF tokens in centreon/centreon | medium | 6.5 | No | No | Yes |
| CVE-2020-10945 | Centreon Sensitive Data Exposure vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2020-13252 | Command Injection in Centreon | high | 8.8 | No | Yes | Yes |
| CVE-2019-16405 | Improper Input Validation in Centreon Web | high | 7.2 | No | Yes | Yes |
| CVE-2019-17106 | Centreon Sensitive Data Exposure | medium | 6.5 | No | No | Yes |
| CVE-2019-17104 | Centreon Does Not Set HTTPOnly Flag | high | 7.5 | No | No | No |
| CVE-2018-21025 | Centreon Privilege Escalation | critical | 9.8 | No | Yes | No |
| CVE-2019-16194 | SQL injection in Centreon | critical | 9.8 | No | No | Yes |
| CVE-2018-19312 | Centreon SQL Injection | high | 8.8 | No | Yes | Yes |
| CVE-2018-19311 | Centreon XSS Vulnerability | medium | 5.4 | No | Yes | Yes |
| CVE-2018-19281 | Centreon allows SNMP trap SQL Injection | critical | 9.8 | No | No | Yes |
| CVE-2018-19280 | Centreon XSS Vulnerability | medium | 6.1 | No | No | Yes |
| CVE-2018-19271 | Centreon SQL Injection | high | 8.8 | No | Yes | Yes |
| CVE-2018-11587 | Centreon RCE Vulnerability | critical | 9.8 | No | No | Yes |
| CVE-2015-7672 | Centreon Cross-site Scripting Vulnerability | medium | 5.4 | No | Yes | Yes |
| CVE-2015-1561 | Centreon Command Injection | high | 8.5 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does Centreon centreon/centreon have?

Centreon centreon/centreon has 27 published CVE records since 2015.

### How many Centreon centreon/centreon CVEs are in CISA KEV?

None of Centreon centreon/centreon's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Centreon centreon/centreon vulnerabilities?

Yes — 11 of Centreon centreon/centreon's CVEs have a known public exploit.

### Which versions of Centreon centreon/centreon are affected?

52 distinct Centreon centreon/centreon versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Centreon centreon/centreon CVEs?

Centreon centreon/centreon's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-330 (Use of Insufficiently Random Values).

### How many critical Centreon centreon/centreon vulnerabilities are there?

Centreon centreon/centreon has 5 critical and 14 high-severity CVEs.

### What is the average severity of Centreon centreon/centreon CVEs?

The average CVSS base score across Centreon centreon/centreon's scored CVEs is 7.7.

## Other products from this vendor

- [Centreon](https://radicalnotion.ai/vendor/centreon/centreon) (128 CVEs)
- [Centreon web](https://radicalnotion.ai/vendor/centreon/centreon-web) (57 CVEs)
- [Infra Monitoring](https://radicalnotion.ai/vendor/centreon/infra-monitoring) (21 CVEs)
- [centreon-archived](https://radicalnotion.ai/vendor/centreon/centreon-archived) (10 CVEs)
- [web](https://radicalnotion.ai/vendor/centreon/web) (7 CVEs)
- [centreon host-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-host-monitoring-widget) (3 CVEs)
- [centreon service-monitoring widget](https://radicalnotion.ai/vendor/centreon/centreon-service-monitoring-widget) (3 CVEs)
- [centreon tactical-overview widget](https://radicalnotion.ai/vendor/centreon/centreon-tactical-overview-widget) (3 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/centreon/centreon-centreon). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.