PT-2021-20094 · Monitorix · Monitorix

Mikaku · Published 2021-01-27 · Updated 2022-07-12 · CVE-2021-3325

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monitorix version 3.13.0

Description The issue allows remote attackers to bypass Basic Authentication in a default installation, which is an installation without a hosts deny option. This occurred because a new access-control feature was introduced without considering that some existing installations became unsafe upon an update to 3.13.0, unless the new feature was immediately configured.

Recommendations For Monitorix version 3.13.0, consider immediately configuring the new access-control feature to prevent remote attackers from bypassing Basic Authentication. As a temporary workaround, restrict access to the default installation to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2021-3325

Affected Products

Monitorix

References · 13

• 🔥 https://github.com/mikaku/Monitorix/issues/309 · Exploit
• https://github.com/mikaku/Monitorix/compare/v3.13.0...v3.13.1 · Patch
• https://github.com/mikaku/Monitorix/commit/d6816e20da1a98bcdc6372d9c36a093df5238f4a · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/67DDUU56LP76AJ2K7WJ733QPL2FHKKNG · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3325 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3325 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3325 · Vendor Advisory
• https://monitorix.org/news.html?n=20210127 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGG6WK44CYY6GEFRTCUEDANVNSX5NDH7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3325 · Security Note
• https://t.me/cvenotify/9008 · Telegram Post
• https://t.me/cibsecurity/22751 · Telegram Post