{"id":"GHSA-jmgg-wx67-7qfv","aliases":["CVE-2020-13252"],"title":"Command Injection in Centreon","description":"Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.","severity":"high","score":8.8,"published":"2021-06-22T15:23:33.000Z","modified":"2026-09-10T03:49:05.913Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"centreon/centreon","ranges":[{"events":[{"introduced":"0"},{"fixed":"19.04.15"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["19.04.15"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-13252","https://github.com/centreon/centreon/pull/8467","https://engindemirbilek.github.io/centreon-19.10-rce","https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.html","https://github.com/centreon/centreon/compare/19.04.13...19.04.15"],"sources":[{"name":"OSV","id":"GHSA-jmgg-wx67-7qfv","modified":"2026-09-10T03:49:05.913145026Z","url":"https://osv.dev/vulnerability/GHSA-jmgg-wx67-7qfv"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}]}