CVE-2022-34872: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

August 3, 2022 (updated August 9, 2022)

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of Virtual Metrics. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16336.

References

docs.centreon.com/docs/21.10/releases/centreon-core/
nvd.nist.gov/vuln/detail/CVE-2022-34872
www.zerodayinitiative.com/advisories/ZDI-22-954/

Detect and mitigate CVE-2022-34872 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →