CVE-2019-19699

There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability, someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.

• CWE-269

• https://download.centreon.com/Vendor Advisory
• https://github.com/SpengeSec/CVE-2019-19699Exploit, Third Party Advisory
• https://spenge.pw/cves/Third Party Advisory
• https://twitter.com/SpengeSec/status/1204418071764463618Third Party Advisory
• https://www.centreon.com/Vendor Advisory
• https://download.centreon.com/Vendor Advisory
• https://github.com/SpengeSec/CVE-2019-19699Exploit, Third Party Advisory
• https://spenge.pw/cves/Third Party Advisory
• https://twitter.com/SpengeSec/status/1204418071764463618Third Party Advisory
• https://www.centreon.com/Vendor Advisory

Published

Apr 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19693The Trend Micro Security 2020 consumer family of products co…7.1
• CVE-2019-19694The Trend Micro Security 2019 (15.0.0.1163 and below) consum…4.7
• CVE-2019-19695A privilege escalation vulnerability in Trend Micro Antiviru…7.5
• CVE-2019-19696A RootCA vulnerability found in Trend Micro Password Manager…5.5
• CVE-2019-19697An arbitrary code execution vulnerability exists in the Tren…6.7
• CVE-2019-19698marc-q libwav through 2017-04-20 has a NULL pointer derefere…6.5
• CVE-2019-1970A vulnerability in the Secure Sockets Layer (SSL)/Transport …7.5
• CVE-2019-19702The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to …7.5
• CVE-2019-19703In Ktor through 1.2.6, the client resends data from the HTTP…6.1
• CVE-2019-19704In JetBrains Upsource before 2020.1, information disclosure …7.5
• CVE-2019-19705Realtek Audio Drivers for Windows, as used on the Lenovo Thi…7.8
• CVE-2019-19707On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with fi…7.5