20.10.10

Centreon Web

20.10.10

July 30, 2021

Enhancements

• [Authentication] Improve centreonAuth.SSO.class for OpenId connection

Bugfixes

• [Administration] LDAP search fails
• [Configuration] Changing a Remote Server's IP address converts it into a simple Poller
• [Configuration] Editing service template removes relations with servicegroups
• [Configuration] Only first servicegroup linked to a service template is exported
• [Core] Unserialize in CentreonUtils is blocked by QualityGate
• [Core] Update copyright date
• [Graph] Can't get a graph with autologin key
• [LDAP] Fixed LDAP auto-sync is always skipped
• [LDAP] LDAP's My account issue
• [Platform Topology] CLAPI's add Instance doesn't add a poller into the platform_topology table
• [Platform Topology] JSON Schema isn't validated in the POST endpoint
• [Platform Topology] Removed unused variable in registerServerTopology.sh
• [Resources Status] No route found for "GET /centreon/api/beta/monitoring/resources/undefineds/133"
• [i18n] Fix typo in error message

20.04.17

Centreon Web

20.04.17

July 30, 2021

Bugfixes

• [Core] Unserialize in CentreonUtils is blocked by QualityGate
• [Core] Update copyright date
• [Graph] Can't get a graph with autologin key
• [LDAP] Fixed LDAP auto-sync is always skipped
• [LDAP] LDAP's My account issue
• [i18n] Fix typo in error message

20.04.16

Centreon Web

20.04.16

July 01, 2021

Bugfixes

• [Configuration] InfluxDB configuration columns are deleted in Broker form

Security fixe

• [Configuration] Input sent to unserialize() are not sanitized
• [Configuration] SQL Injection on commands
• [Configuration] SQL Injection on host dependency
• [Configuration] SQL Injection on hostgroup dependency
• [Configuration] SQL Injection on metaservice
• [Configuration] SQL Injection on metaservice dependency
• [Configuration] SQL Injection on service categories
• [Configuration] SQL Injection on service dependency
• [Configuration] SQL Injection on servicegroup
• [Configuration] SQL Injection on servicegroup dependency
• [Configuration] SQL Injection on timeperiod
• [Configuration] XSS Stored on checks command
• [Core] Manage security acknowledgement

20.10.9

Centreon Web

20.10.9

June 30, 2021

Bugfixes

• [APIv2] Use poller's page ACL rights on Topology API endpoints
• [Configuration] InfluxDB configuration columns are deleted in Broker form
• [Downtime] Can not remove/delete periods when configuring recurrent downtime
• [Platform Topology] Update Exception handling

Security fixe

• [Configuration] Input sent to unserialize() are not sanitized
• [Configuration] SQL Injection on commands
• [Configuration] SQL Injection on host dependency
• [Configuration] SQL Injection on hostgroup dependency
• [Configuration] SQL Injection on metaservice
• [Configuration] SQL Injection on metaservice dependency
• [Configuration] SQL Injection on service categories
• [Configuration] SQL Injection on service dependency
• [Configuration] SQL Injection on servicegroup
• [Configuration] SQL Injection on servicegroup dependency
• [Configuration] SQL Injection on timeperiod
• [Configuration] XSS Stored on checks command
• [Core] Manage security acknowledgement

21.04.3

Centreon Web

21.04.3

June 28, 2021

Enhancements

• [Core] Implement API log mechanism
• [Graph] Diverse export size options

Bugfixes

• [APIv2] Use poller's page ACL rights on Topology API endpoints
• [Configuration] InfluxDB configuration columns are deleted in Broker form
• [Downtime] Can not remove/delete periods when configuring recurrent downtime
• [Graph] Anchor point does not follow line path for stacked graphs
• [Platform Topology] Update Exception handling

Security fixe

• [Configuration] Input sent to unserialize() are not sanitized
• [Configuration] SQL Injection on commands
• [Configuration] SQL Injection on host dependency
• [Configuration] SQL Injection on hostgroup dependency
• [Configuration] SQL Injection on metaservice
• [Configuration] SQL Injection on metaservice dependency
• [Configuration] SQL Injection on service categories
• [Configuration] SQL Injection on service dependency
• [Configuration] SQL Injection on servicegroup
• [Configuration] SQL Injection on servicegroup dependency
• [Configuration] SQL Injection on timeperiod
• [Configuration] XSS Stored on checks command
• [Core] Manage security acknowledgement

20.04.15

Centreon Web

20.04.15

June 10, 2021

Bugfixes

• [Core] Fixed broken configuration export

21.04.2

21.04.2

June 7, 2021

Bugfixes

• [APIv1] Cannot send external commands anymore
• [APIv2] Can not authenticate using API when database name and database username are different from default
• [APIv2] DELETE downtime on host not functionnal
• [APIv2] Unable to use v2 api (internal server error)
• [Administration] Broker statistics for pollers are not shown
• [Anomaly] host_id is null is stream connector flow
• [Configuration] Change default values for Centreon Engine
• [Configuration] New Logger conf is not exported to distant pollers well
• [Configuration] Unable to replace 127.0.0.1 by real IP in poller form when already saved in platform_topology
• [Core] Avoid 404 redirection
• [Install] Cannot update when you have no metaservices
• [LDAP] Adding new user from LDAP results in Request Entity Too Large error
• [Purge] Script can't drop several partitions
• [Reporting] Dashboard can't display reporting for service (query too long)
• [Resources Status] "Filter by Host" filter is not emptied between searches
• [Resources Status] Action ACL not working
• [Resources Status] Apply ACL in command line block
• [Resources Status] Increase font size of Timestamp in graph

Security fixes

• [Administration] Import of JS in image files
• [Administration] Insecure media file upload
• [Administration] SQL Injection on ACL actions
• [Administration] SQL Injection on ACL resources
• [Administration] SQL Injection on reload ACL
• [Configuration] SQL Injection on MediaWiki
• [Configuration] SQL Injection on SNMP trap manufacturer
• [Configuration] SQL Injection on poller form
• [Configuration] Unserialize() are not sanitized in Centreon Broker wizard
• [Configuration] Unserialize() are not sanitized in poller wizard
• [Configuration] XSS reflected on Graph performance curves
• [Configuration] XSS reflected on SNMP trap
• [Configuration] XSS reflected on internal API broker configuration
• [Graphs] SQL Injection on Graph component templates
• [Graphs] SQL Injection on Graph generate image
• [Graphs] SQL Injection on Graph periods
• [Graphs] SQL Injection on Graph split
• [Reporting] SQL Injection on reporting export
• [Install] Packaging, remove . gitignore files

Performance

• [ACL] ACL are computed every time for BV
• [Generation] Bulk insert in index_data during config generation
• [Purge] Purge of index_data is taking too long because of suboptimal SQL query

20.10.8

20.10.8

June 7, 2021

Bugfixes

• [APIv1] Cannot send external commands anymore
• [APIv2] Can not authenticate using API when database name and database username are different from default
• [APIv2] DELETE downtime on host not functionnal
• [APIv2] Unable to use v2 api (internal server error)
• [Administration] Broker statistics for pollers are not shown
• [Anomaly] host_id is null is stream connector flow
• [Configuration] Change default values for Centreon Engine
• [Configuration] Unable to add a Poller with the Wizard
• [Core] Avoid 404 redirection
• [Install] Cannot update when you have no metaservices
• [LDAP] Adding new user from LDAP results in Request Entity Too Large error
• [Reporting] Dashboard can't display reporting for service (query too long)
• [Resources Status] "Filter by Host" filter is not emptied between searches
• [Resources Status] Action ACL not working
• [Resources Status] Apply ACL in command line block
• [Resources Status] Manage not filled curves

Security fixes

• [Administration] Import of JS in image files
• [Administration] Insecure media file upload
• [Administration] SQL Injection on ACL actions
• [Administration] SQL Injection on ACL resources
• [Administration] SQL Injection on reload ACL
• [Configuration] SQL Injection on MediaWiki
• [Configuration] SQL Injection on SNMP trap manufacturer
• [Configuration] SQL Injection on poller form
• [Configuration] Unserialize() are not sanitized in Centreon Broker wizard
• [Configuration] Unserialize() are not sanitized in poller wizard
• [Configuration] XSS reflected on Graph performance curves
• [Configuration] XSS reflected on SNMP trap
• [Configuration] XSS reflected on internal API broker configuration
• [Graph] SQL Injection on Graph component templates
• [Graph] SQL Injection on Graph generate image
• [Install] Packaging, remove . gitignore files
• [Reporting] SQL Injection on reporting export

Performance

• [ACL] ACL are computed every time for BV
• [Generation] Bulk insert in index_data during config generation
• [Purge] Purge of index_data is taking too long because of suboptimal SQL query

20.04.14

Centreon Web

June 3, 2021

20.04.14

Bugfixes

• [Administration] Broker statistics for pollers are not shown
• [APIv1] Cannot send external commands anymore
• [APIv2] Unable to use v2 api (internal server error)
• [APIv2] Can not authenticate using API when database name and database username are different from default
• [Core] Avoid 404 redirection
• [Install] Cannot update when you have no metaservices

Security fixes

• [Administration] Import of JS in image files
• [Administration] Insecure media file upload
• [Administration] SQL Injection on ACL actions
• [Administration] SQL Injection on ACL resources
• [Administration] SQL Injection on reload ACL
• [Configuration] SQL Injection on MediaWiki
• [Configuration] SQL Injection on SNMP trap manufacturer
• [Configuration] SQL Injection on poller form
• [Configuration] Unserialize() are not sanitized in Centreon Broker wizard
• [Configuration] Unserialize() are not sanitized in poller wizard
• [Configuration] XSS reflected on Graph performance curves
• [Configuration] XSS reflected on SNMP trap
• [Configuration] XSS reflected on internal API broker configuration
• [Graph] SQL Injection on Graph component templates
• [Graph] SQL Injection on Graph generate image
• [Install] Packaging, remove . gitignore files
• [Reporting] SQL Injection on reporting export

Performance

• [ACL] ACL are computed every time for BV
• [Generation] Bulk insert in index_data during config generation
• [Purge] Purge of index_data is taking too long because of suboptimal SQL query

2.8.38

###################
Centreon Web 2.8.38
###################

Security

• SQL Injection on Graph component templates
• SQL Injection on Graph generate image
• SQL Injection on MediaWiki
• SQL Injection on reporting export
• Stored XSS in host alias for host form
• XSS Reflected on Graph performance curves
• XSS Reflected on internal broker configuration API