CVE-2022-42427

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the contact groups configuration page. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18541.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Centreon	Centreon	22.04

References

https://www.zerodayinitiative.com/advisories/ZDI-22-1398/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-1398/Third Party Advisory, VDB Entry

Timeline

Published: Mar 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-424288.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to explo CVE-2022-424298.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to explo CVE-2022-42434.8The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2022-424307.8This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to ex CVE-2022-424317.8This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to ex CVE-2022-424324.4This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attack CVE-2022-424338.0This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_CVE-2022-424358.8IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 CVE-2022-424363.3IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic file CVE-2022-424388.8IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying dire CVE-2022-424394.9IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Conn CVE-2022-42447.5A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stor