Raw vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-0637 is a high-severity SQL Injection (CWE-89) vulnerability in Centreon Centreon Web. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Protocol or Service Impersonation (T1001.003); ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-0637 is a SQL injection vulnerability in the updateDirectory function of Centreon that leads to remote code execution. The flaw arises from missing validation of user-supplied input before it is used to build SQL queries, allowing an attacker to influence query logic and ultimately run code under the service account. It affects authenticated sessions on vulnerable Centreon installations and is tracked as CWE-89 with a CVSS 3.0 score of 8.8.
An attacker who already possesses valid credentials can send a crafted request to the updateDirectory endpoint and achieve arbitrary code execution on the server. No unauthenticated exploitation path is described.
The Zero Day Initiative published advisory ZDI-24-118 for this issue. The EPSS score stands at 0.7871 with no material increase from its recorded peak.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1050
Vulnerability Data
Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateDirectory function. The issue results…
more
from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22294.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover SQLi flaws before deployment but does not stop their introduction.
Input validation directly stops untrusted data from reaching SQL query construction without neutralization.
Secure engineering principles require parameterized queries and input sanitization that structurally eliminate SQLi.
System monitoring can identify attempted SQLi exploitation via anomalous queries after the weakness exists.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.6 only improves knowledge flow, awareness of threats/patches and access to specialist advice; it does not stop SQL injection from being exploitable in code that still contains the flaw.