cvelistv5 - cve-2025-3767

CVE-2025-3767 (GCVE-0-2025-3767)

Vulnerability from cvelistv5 – Published: 2025-04-22 15:16 – Updated: 2025-04-22 16:09

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

Centreon

References

URL

Tags

	https://thewatch.centreon.com/latest-security-bul…	vendor-advisory
	https://github.com/centreon/centreon/releases	release-notes

Impacted products

	Vendor	Product	Version
	Centreon	Centreon BAM	Affected: 24.10 , < 24.10.1 (semver) Affected: 24.04 , < 24.04.5 (semver) Affected: 23.10 , < 23.10.10 (semver) Affected: 23.04 , < 23.04.10 (semver)

Credits

Matthew Taylor, Ludovic Tavernier and Remi Millerand from Algosecure

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T16:03:03.920840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T16:03:14.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Boolean KPI listing"
          ],
          "packageName": "centreon-bam",
          "product": "Centreon BAM",
          "vendor": "Centreon",
          "versions": [
            {
              "lessThan": "24.10.1",
              "status": "affected",
              "version": "24.10",
              "versionType": "semver"
            },
            {
              "lessThan": "24.04.5",
              "status": "affected",
              "version": "24.04",
              "versionType": "semver"
            },
            {
              "lessThan": "23.10.10",
              "status": "affected",
              "version": "23.10",
              "versionType": "semver"
            },
            {
              "lessThan": "23.04.10",
              "status": "affected",
              "version": "23.04",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthew Taylor, Ludovic Tavernier and Remi Millerand from Algosecure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\u003cbr\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis page is only accessible to authenticated users with high privileges.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.\u003c/span\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\n\n\nThis page is only accessible to authenticated users with high privileges.\n\nThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-22T16:09:54.998Z",
        "orgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "shortName": "Centreon"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/centreon/centreon/releases"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "SQL Injection in Centreon BAM boolean KPI listing",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
    "assignerShortName": "Centreon",
    "cveId": "CVE-2025-3767",
    "datePublished": "2025-04-22T15:16:24.312Z",
    "dateReserved": "2025-04-17T14:36:19.597Z",
    "dateUpdated": "2025-04-22T16:09:54.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-3767\",\"sourceIdentifier\":\"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\",\"published\":\"2025-04-22T16:15:45.487\",\"lastModified\":\"2025-04-23T14:08:13.383\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\\n\\n\\nThis page is only accessible to authenticated users with high privileges.\\n\\nThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Elementos Especiales utilizados en un Comando SQL (\u0027Inyecci\u00f3n SQL\u0027) en Centreon BAM (m\u00f3dulos de Listado de KPI Booleanos) permite la Inyecci\u00f3n SQL. Esta p\u00e1gina solo es accesible para usuarios autenticados con privilegios elevados. Este problema afecta a Centreon BAM: desde la versi\u00f3n 24.10 hasta la 24.10.1, desde la versi\u00f3n 24.04 hasta la 24.04.5, desde la versi\u00f3n 23.10 hasta la 23.10.10, desde la versi\u00f3n 23.04 hasta la 23.04.10.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://github.com/centreon/centreon/releases\",\"source\":\"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\"},{\"url\":\"https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459\",\"source\":\"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3767\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-22T16:03:03.920840Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-22T16:03:08.642Z\"}}], \"cna\": {\"title\": \"SQL Injection in Centreon BAM boolean KPI listing\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Matthew Taylor, Ludovic Tavernier and Remi Millerand from Algosecure\"}], \"impacts\": [{\"capecId\": \"CAPEC-66\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-66 SQL Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Centreon\", \"modules\": [\"Boolean KPI listing\"], \"product\": \"Centreon BAM\", \"versions\": [{\"status\": \"affected\", \"version\": \"24.10\", \"lessThan\": \"24.10.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"24.04\", \"lessThan\": \"24.04.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.10\", \"lessThan\": \"23.10.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.04\", \"lessThan\": \"23.04.10\", \"versionType\": \"semver\"}], \"packageName\": \"centreon-bam\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/centreon/centreon/releases\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\\n\\n\\nThis page is only accessible to authenticated users with high privileges.\\n\\nThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\u003cbr\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThis page is only accessible to authenticated users with high privileges.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan style=\\\"background-color: var(--wht);\\\"\u003eThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\", \"shortName\": \"Centreon\", \"dateUpdated\": \"2025-04-22T16:09:54.998Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-3767\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-22T16:09:54.998Z\", \"dateReserved\": \"2025-04-17T14:36:19.597Z\", \"assignerOrgId\": \"bd4443e6-1eef-43f3-9886-25fc9ceeaae7\", \"datePublished\": \"2025-04-22T15:16:24.312Z\", \"assignerShortName\": \"Centreon\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-3767

Vulnerability from fkie_nvd - Published: 2025-04-22 16:15 - Updated: 2025-04-23 14:08

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	bd4443e6-1eef-43f3-9886-25fc9ceeaae7	https://github.com/centreon/centreon/releases
	bd4443e6-1eef-43f3-9886-25fc9ceeaae7	https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\n\n\nThis page is only accessible to authenticated users with high privileges.\n\nThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Elementos Especiales utilizados en un Comando SQL (\u0027Inyecci\u00f3n SQL\u0027) en Centreon BAM (m\u00f3dulos de Listado de KPI Booleanos) permite la Inyecci\u00f3n SQL. Esta p\u00e1gina solo es accesible para usuarios autenticados con privilegios elevados. Este problema afecta a Centreon BAM: desde la versi\u00f3n 24.10 hasta la 24.10.1, desde la versi\u00f3n 24.04 hasta la 24.04.5, desde la versi\u00f3n 23.10 hasta la 23.10.10, desde la versi\u00f3n 23.04 hasta la 23.04.10."
    }
  ],
  "id": "CVE-2025-3767",
  "lastModified": "2025-04-23T14:08:13.383",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-22T16:15:45.487",
  "references": [
    {
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "url": "https://github.com/centreon/centreon/releases"
    },
    {
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459"
    }
  ],
  "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7",
      "type": "Secondary"
    }
  ]
}

GHSA-XMR8-XW2G-RQH3

Vulnerability from github – Published: 2025-04-22 18:32 – Updated: 2025-04-22 18:32

Details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.

This page is only accessible to authenticated users with high privileges.

This issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.

Severity ?

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-3767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-22T16:15:45Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.\n\n\nThis page is only accessible to authenticated users with high privileges.\n\nThis issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.",
  "id": "GHSA-xmr8-xw2g-rqh3",
  "modified": "2025-04-22T18:32:11Z",
  "published": "2025-04-22T18:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3767"
    },
    {
      "type": "WEB",
      "url": "https://github.com/centreon/centreon/releases"
    },
    {
      "type": "WEB",
      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-3767 (GCVE-0-2025-3767)

FKIE_CVE-2025-3767

GHSA-XMR8-XW2G-RQH3

Tags

Sightings

Nomenclature