PT-2017-16936 · Project Munin+2 · Munin+2

Stevie Trujillo · Publicado 2017-02-22 · Atualizado 2024-06-15 · CVE-2017-6188

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Munin versions prior to 2.999.6

Description The issue allows for local file write access when CGI graphs are enabled. By setting multiple upper limit GET parameters, it is possible to overwrite any file accessible to the www-data user. This can be achieved through specific API endpoints, although the exact endpoints are not specified.

Recommendations For versions prior to 2.999.6, update to version 2.999.6 or later to resolve the issue. As a temporary workaround, consider disabling CGI graphs until a patch is available. Restrict access to files accessible by the www-data user to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6188

DLA-836-1

DSA-3794-1

DSA-3794-2

DSA-3794-3

MGASA-2017-0101

OPENSUSE-SU-2017_0621-1

OPENSUSE-SU-2024:11067-1

USN-3215-1

USN-3215-2

Produtos afetados

Munin

Suse

Ubuntu

Referências · 25

• https://github.com/munin-monitoring/munin/issues/721 · Correção
• https://ubuntu.com/security/notices/USN-3215-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3794-3 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-6188 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6188 · Aviso do Fabricante
• https://debian.org/security/2017/dsa-3794 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6188 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3794-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2017-0101 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0101.html · Nota de Segurança
• https://ubuntu.com/security/notices/USN-3215-2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6188 · Aviso do Fabricante
• https://launchpad.net/bugs/1669764 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-6188 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6188 · Aviso do Fabricante