Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at…
Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Checkmk GmbH
- Product
- Checkmk
- CVSS v4.0
- 9.4 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-88
- Exposure class
- Developer platform, Network management
- NVD status
- Deferred
Why it ranks 38 (Notable)
- CVSS v4.0 9.4 critical
- Product class: developer platform, network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.