CVE-2021-40905

Katalog CVE

CVSS 8.8 · High EPSS 3,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada checkmk, tribe29 checkmk. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner.

Rincian

Terbit di NVD

25 Maret 2022

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 87,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Edgarloyola/CVE-2021-40905 exploit · advisory pihak ketiga
• https://docs.checkmk.com/latest/en/mkps.html