CVE-2024-55573 — AI Deep Analysis Summary

🚨 **Essence**: Centreon Web has a **SQL Injection** flaw in the **Virtual Metrics** creation form.…

🛡️ **Root Cause**: **SQL Injection** (SQLi). The vulnerability stems from insufficient input validation in the form used to create virtual metrics, allowing attackers to manipulate backend database queries.…

📦 **Affected Products**: Centreon Open Source Monitoring Tool. 📅 **Affected Versions**: • 24.10.x (before 24.10.3) • 24.04.x (before 24.04.9) • 23.10.x (before 23.10.19) • 23.04.x (before 23.04.24)

💀 **Attacker Capabilities**: With **High Privileges**, hackers can execute arbitrary SQL commands. 📊 **Impact**: Full **Confidentiality**, **Integrity**, and **Availability** loss.…

🔒 **Exploitation Threshold**: **High**. Requires **Privileged User Access** (PR:H). 🚫 **Note**: It is NOT remote unauthenticated.…

🕵️ **Public Exploit**: **No**. The `pocs` field is empty. 🌐 **References**: Official release notes and security bulletins are available, but no public PoC or wild exploitation code is listed in the data.

🔍 **Self-Check**: 1. Check your Centreon version against the affected list. 2. Audit access to the **Virtual Metrics** creation form. 3. Monitor logs for unusual SQL syntax in metric creation requests.…

✅ **Official Fix**: **Yes**. Updates are available in the latest releases (e.g., 24.10.3, 24.04.9, etc.). 📥 **Action**: Upgrade immediately to the patched versions listed in the references.

🚧 **No Patch Workaround**: 1. **Restrict Access**: Limit high-privilege users who can create virtual metrics. 2.…

⚡ **Urgency**: **HIGH**. Despite requiring high privileges, the impact is **Critical** (CVSS: 9.8). 🎯 **Priority**: Patch immediately. The damage potential (full DB control) outweighs the access requirement.…