PT-2017-13776 · Mathias Kettner+1 · Checkmk+1

Julien Ahrens · Published 2017-10-01 · Updated 2024-07-23 · CVE-2017-14955

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Check MK versions prior to 1.2.8p26

Description The issue arises from a race condition in the failed-login save feature, allowing remote attackers to obtain sensitive user information by reading a GUI crash report. This occurs due to the mishandling of certain errors within the feature.

Recommendations For versions prior to 1.2.8p26, update to version 1.2.8p26 or later to resolve the issue. As a temporary workaround, consider restricting access to GUI crash reports to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Information Disclosure

Weakness Enumeration

CWE-362

CWE-200

Related Identifiers

CVE-2017-14955

USN-5527-1

USN-5527-2

Affected Products

Checkmk

Ubuntu

References · 26

• 🔥 https://github.com/Edgarloyola/CVE-2021-36563 · Exploit
• 🔥 https://exploit-db.com/exploits/43021 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36563 · Security Note
• https://ubuntu.com/security/notices/USN-5527-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9781 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9781 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40906 · Security Note
• https://ubuntu.com/security/CVE-2022-24565 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14955 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24565 · Security Note
• https://ubuntu.com/security/CVE-2021-36563 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5527-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14955 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14955 · Security Note