{"id":"GHSA-2q95-593f-g7h7","aliases":["CVE-2020-22345"],"title":"OS Command Injection in Centreon","description":"/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.","severity":"high","score":8.8,"published":"2021-09-02T17:16:06.000Z","modified":"2026-09-10T03:49:15.691Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"centreon/centreon","ranges":[{"events":[{"introduced":"0"},{"fixed":"20.04.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["20.04.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-22345","https://github.com/centreon/centreon/pull/8467#event-3163627607","https://engindemirbilek.github.io/centreon-19.10-rce","https://github.com/centreon/centreon"],"sources":[{"name":"OSV","id":"GHSA-2q95-593f-g7h7","modified":"2026-09-10T03:49:15.691350722Z","url":"https://osv.dev/vulnerability/GHSA-2q95-593f-g7h7"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"evidence":[]}