PT-2017-16936 · Project Munin+2 · Munin+2

Stevie Trujillo · Published 2017-02-22 · Updated 2024-06-15 · CVE-2017-6188

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Munin versions prior to 2.999.6

Description The issue allows for local file write access when CGI graphs are enabled. By setting multiple upper limit GET parameters, it is possible to overwrite any file accessible to the www-data user. This can be achieved through specific API endpoints, although the exact endpoints are not specified.

Recommendations For versions prior to 2.999.6, update to version 2.999.6 or later to resolve the issue. As a temporary workaround, consider disabling CGI graphs until a patch is available. Restrict access to files accessible by the www-data user to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6188

DLA-836-1

DSA-3794-1

DSA-3794-2

DSA-3794-3

MGASA-2017-0101

OPENSUSE-SU-2017_0621-1

OPENSUSE-SU-2024:11067-1

USN-3215-1

USN-3215-2

Affected Products

Munin

Suse

Ubuntu

References · 25

• https://github.com/munin-monitoring/munin/issues/721 · Patch
• https://ubuntu.com/security/notices/USN-3215-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3794-3 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6188 · Vendor Advisory
• https://debian.org/security/2017/dsa-3794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6188 · Security Note
• https://osv.dev/vulnerability/DSA-3794-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0101 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0101.html · Security Note
• https://ubuntu.com/security/notices/USN-3215-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6188 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6188 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6188 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-05 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6188 · Vendor Advisory