CVE-2019-16405
Improper Input Validation in Centreon Web
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
- Record
CVE-2019-16405- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
- Record
CVE-2019-16405- Updated
- 2026-11-02
EUVDEUVD-2021-1439 No score
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
- Record
EUVD-2021-1439- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4f26-v6fr-9hmp
Improper Input Validation in Centreon Web
Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings.
- Record
GHSA-4f26-v6fr-9hmp- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-4f26-v6fr-9hmp
Improper Input Validation in Centreon Web
Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings.
- Record
GHSA-4f26-v6fr-9hmp- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
centreon/centreonPackagist |
before 18.10.8 | 18.10.8 |
centreon/centreonPackagist |
19.0.0 up to 19.04.5 | 19.04.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Centreon 19.04 - Authenticated Remote Code Execution (Metasploit) | 2020-01-20 |
| PoC in GitHub | TheCyberGeek/CVE-2019-16405.rb | 2019-10-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16405 is a high vulnerability (CVSS 7.2) in Centreon Web, published November 21, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 27.0%, the 98th percentile. Fixed in centreon/centreon 18.10.8.
References
thecybergeek.co.uk/cves/2019/09/17/CVE-2019-16405-06.html
github.com/TheCyberGeek/CVE-2019-16405.rb
documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html
Show 8 moreShow less
packetstormsecurity.com/files/155999/Centreon-19.04-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2019-16405