CVE-2022-3827 json
centreon Contact Groups Form formContactGroup.php sql injection
published 4y ago modified last mo. also GHSA-j5wx-jvw3-j363 , EUVD-2022-7370
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql injection. The attack can be initiated remotely. The name of the patch is 293b10628f7d9f83c6c82c78cf637cbe9b907369. It is recommended to apply a patch to fix this issue. VDB-212794 is the identifier assigned to this vulnerability.
Patch / fix
- packagist centreon/centreon 22.10.0-beta1
- centreon centreon 22.10.0
- github.com/centreon/centreon@293b106 commit
- github.com/centreon/centreon#11869 pull request
Is CVE-2022-3827 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | centreon/centreon | <22.10.0-beta1 |
22.10.0-beta1 |
Affected products
- unspecified centreon
Classification
References
-
github.com
/centreon/centreon/pull/11869
web, issue-tracking, patch, third-party-advisory
-
github.com
/centreon/centreon/commit/293b10628f7d9f83c6c82c78cf637cbe9b907369
web, patch, third-party-advisory
-
vuldb.com
/?id.212794
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-3827
advisory
-
github.com
/centreon/centreon
package
Sources
- CVE List CVE-2022-3827
- GitHub Advisory GHSA-j5wx-jvw3-j363
- NVD CVE-2022-3827
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.