CVE-2021-40905

Опубликовано: 25 мар. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner

Ссылки

http://checkmk.com
Product
https://github.com/Edgarloyola/CVE-2021-40905
Exploit
Third Party Advisory
http://checkmk.com
Product
https://github.com/Edgarloyola/CVE-2021-40905
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:checkmk:checkmk:2.0.0:-:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b1:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b2:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b3:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b4:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b5:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b6:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b7:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:b8:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:i1:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p1:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p10:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p11:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p12:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p13:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p14:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p15:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p16:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p17:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p2:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p3:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p4:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p5:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p6:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p7:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p8:*:*:*:*:*:*

cpe:2.3:a:checkmk:checkmk:2.0.0:p9:*:*:*:*:*:*

cpe:2.3:a:tribe29:checkmk:*:*:*:*:*:*:*:*

Версия от 1.5.0 (включая) до 2.0.0 (исключая)

EPSS

Процентиль: 89%

0.04878

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-83pm-xjc4-cg4w