Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service…
Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Checkmk GmbH
- Product
- Checkmk
- CVSS v4.0
- 6.3 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-277
- Exposure class
- Network management
- NVD status
- Deferred
Why it ranks 10 (Routine)
- CVSS v4.0 6.3 medium
- Product class: network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.