What is CVE-2015-1561?

CVE-2015-1561 is a vulnerability in Centreon, classified under Command Injection. Published 2015-07-14.

Is CVE-2015-1561 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Centreon

CVE-2015-1561

The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.091 (94.8th percentile) — read the EPSS interpretation.

Affected products

Centreon
N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2015-1561?: CVE-2015-1561 is a vulnerability in Centreon, classified under Command Injection. Published 2015-07-14.
Is CVE-2015-1561 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.