Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls…
Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Checkmk GmbH
- Product
- Checkmk
- CVSS v4.0
- 9.4 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-23
- Exposure class
- Network management
- NVD status
- Deferred
Why it ranks 38 (Notable)
- CVSS v4.0 9.4 critical
- Product class: network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.