OS Command Injection in Centreon

HIGH 8.8CVE-2020-22345 · GHSA-2q95-593f-g7h7 · Published 18/08/2021 · updated 17/06/2026

In short

CVE-2020-22345 is a HIGH (CVSS 8.8) vulnerability affecting centreon/centreon, centreon (centreon).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.1% of all vulnerabilities.
Fix: update to 20.04.0 or later.

Package	Affected versions	Patched versions
centreon/centreon Packagist	`< 20.04.0`	`20.04.0`
centreon centreon	`= 19.10.8`	No fix yet

Description

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.

NVD description

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.

References

nvd.nist.gov/vuln/detail/CVE-2020-22345 · ADVISORY
centreon/centreon#8467 · WEB
engindemirbilek.github.io/centreon-19.10-rce · WEB
centreon/centreon · PACKAGE

More vulnerabilities in centreon/centreon

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

centreon/centreon

Packagist

< 20.04.0

20.04.0

centreon

= 19.10.8

No fix yet

Description

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.

NVD description

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.

More vulnerabilities in centreon/centreon

See all →