PT-2017-13776 · Mathias Kettner+1 · Checkmk+1

Julien Ahrens · Publicado 2017-10-01 · Atualizado 2024-07-23 · CVE-2017-14955

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Check MK versions prior to 1.2.8p26

Description The issue arises from a race condition in the failed-login save feature, allowing remote attackers to obtain sensitive user information by reading a GUI crash report. This occurs due to the mishandling of certain errors within the feature.

Recommendations For versions prior to 1.2.8p26, update to version 1.2.8p26 or later to resolve the issue. As a temporary workaround, consider restricting access to GUI crash reports to minimize the risk of exploitation.

Exploit

Correção

Race Condition

Information Disclosure

Enumeração de Fraquezas

CWE-362

CWE-200

Identificadores relacionados

CVE-2017-14955

USN-5527-1

USN-5527-2

Produtos afetados

Checkmk

Ubuntu

Referências · 26

• 🔥 https://github.com/Edgarloyola/CVE-2021-36563 · Exploit
• 🔥 https://exploit-db.com/exploits/43021 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36563 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-5527-2 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-9781 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9781 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40906 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-24565 · Aviso do Fabricante
• https://t.me/cvenotify/87160 · Publicação no Telegram
• http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=a4a2cc1f30ff6032899ca80eed29fa26b8898c54 · Nota
• https://t.me/cvenotify/87155 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14955 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24565 · Nota de Segurança
• http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8 · Nota
• https://ubuntu.com/security/CVE-2021-36563 · Aviso do Fabricante