Centreon RCE Vulnerability

CRITICAL 9.8CVE-2018-11587 · GHSA-c8qc-cp8v-prpx · Published 25/06/2018 · updated 17/06/2026

In short

CVE-2018-11587 is a CRITICAL (CVSS 9.8) vulnerability affecting centreon/centreon, centreon (centreon), centreon web (centreon).
Chance of exploitation in the next 30 days (EPSS): 4.2%, higher than 90.9% of all vulnerabilities.
Fix: update to 2.8.24 or later.

Package	Affected versions	Patched versions
centreon/centreon Packagist	`= 3.4.6≥ 2.8.23, < 2.8.24`	`2.8.24`
centreon centreon	`= 3.4.6`	No fix yet
centreon web centreon	`= 2.8.23`	No fix yet

Description

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

NVD description

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

References

nvd.nist.gov/vuln/detail/CVE-2018-11587 · ADVISORY
centreon/centreon-archived#6263 · WEB
centreon/centreon-archived#6263 · WEB
documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html · WEB
centreon/centreon#6263 · Third Party Advisory
centreon/centreon release · Third Party Advisory

More vulnerabilities in centreon/centreon

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

centreon/centreon

Packagist

= 3.4.6≥ 2.8.23, < 2.8.24

2.8.24

centreon

= 3.4.6

No fix yet

centreon web

centreon

= 2.8.23

No fix yet

Description

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

NVD description

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

More vulnerabilities in centreon/centreon

See all →