PT-2015-3705 · Mathias Kettner · Checkmk

Publicado 2015-08-31 · Atualizado 2015-09-01 · CVE-2014-2330

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Check MK versions prior to 1.2.5i2

Description The issue affects the Multisite GUI in Check MK, where multiple cross-site request forgery (CSRF) vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of users for requests, including uploading arbitrary snapshots and deleting arbitrary files. The impact of these vulnerabilities could be further reaching, although the specifics are not detailed.

Recommendations For versions prior to 1.2.5i2, update to version 1.2.5i2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Multisite GUI to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-2330

Produtos afetados

Checkmk

Referências · 8

• http://packetstormsecurity.com/files/125850/DTC-A-20140324-002.txt · Nota
• http://securityfocus.com/bid/66389 · Nota
• http://mathias-kettner.de/check_mk_werks.php?werk_id=0766 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-2330 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2330 · Nota de Segurança
• http://securityfocus.com/archive/1/531594 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2330 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-2330 · Nota de Segurança