PT-2022-23910 · Unknown · Shinken Monitoring

Nicolas Perraud · Published 2022-10-20 · Updated 2025-05-08 · CVE-2022-37298

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shinken Monitoring version 2.4.3

Description The issue is related to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.

Recommendations For version 2.4.3, consider disabling the SafeUnpickler class until a patch is available to mitigate the risk of exploitation. Restrict access to the shinken/safepickle.py module to minimize the risk of unauthorized access. Avoid using the SafeUnpickler class for unserializing objects from monitoring nodes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-37298

GHSA-P373-JQFM-J6WR

Affected Products

Shinken Monitoring

References · 8

• 🔥 https://github.com/dbyio/cve-2022-37298 · Exploit
• https://github.com/naparuba/shinken/commit/2dae40fd1e713aec9e1966a0ab7a580b9180cff2 · Patch
• https://osv.dev/vulnerability/CVE-2022-37298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37298 · Security Note
• https://osv.dev/vulnerability/GHSA-p373-jqfm-j6wr · Vendor Advisory
• https://github.com/naparuba/shinken · Note
• https://t.me/cibsecurity/51866 · Telegram Post
• https://t.me/cvenotify/121377 · Telegram Post