CVE-2014-3829

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.

• CWE-94

• http://seclists.org/fulldisclosure/2014/Oct/78Exploit
• http://www.kb.cert.org/vuls/id/298796Third Party Advisory, US Government Resource
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
• https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
• http://seclists.org/fulldisclosure/2014/Oct/78Exploit
• http://www.kb.cert.org/vuls/id/298796Third Party Advisory, US Government Resource
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
• https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

Published

Oct 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3823The Juniper Junos Pulse Secure Access Service (SSL VPN) devi…
• CVE-2014-3824Cross-site scripting (XSS) vulnerability in the web server i…
• CVE-2014-3825The Juniper SRX Series devices with Junos 11.4 before 11.4R1…
• CVE-2014-3826Cross-site scripting (XSS) vulnerability in MyBB before 1.6.…5.4
• CVE-2014-3827Multiple cross-site scripting (XSS) vulnerabilities in the M…5.4
• CVE-2014-3828Multiple SQL injection vulnerabilities in Centreon 2.5.1 and…
• CVE-2014-3830Cross-site scripting (XSS) vulnerability in info.php in Toma…
• CVE-2014-3831Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3832Cross-site scripting (XSS) vulnerability in the Documents co…
• CVE-2014-3833Multiple cross-site scripting (XSS) vulnerabilities in the (…
• CVE-2014-3834ownCloud Server before 6.0.3 does not properly check permiss…
• CVE-2014-3835ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does no…