PT-2023-15897 · Checkmk · Checkmk

Niko Wenselowski · Publicado 2023-01-09 · Atualizado 2024-07-23 · CVE-2022-4884

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.0.0 through 2.0.0p32 Checkmk versions 2.1.0 through 2.1.0p18

Description The issue allows an administrator to write mkp files to arbitrary locations via a malicious mkp file, due to a path-traversal vulnerability in MKP storing.

Recommendations For Checkmk versions 2.0.0 through 2.0.0p32, update to a version later than 2.0.0p32 to resolve the issue. For Checkmk versions 2.1.0 through 2.1.0p18, update to a version later than 2.1.0p18 to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2022-4884

Produtos afetados

Checkmk

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-4884 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2022-4884 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-4884 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-4884 · Aviso do Fabricante
• https://checkmk.com/werk/15065 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4884 · Aviso do Fabricante
• https://t.me/cibsecurity/56165 · Publicação no Telegram