CyberRota Analysis
AI-GeneratedA critical Server-Side Template Injection vulnerability in Centreon's centreon-open-tickets module allows authenticated users to inject and execute arbitrary code on the server due to unsanitized input in the message_confirm field. This can lead to the disclosure of sensitive environment secrets and potential disruption of the Centreon Infra Monitoring platform's availability. Organizations using this product should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.