Ubuntu.comUB:CVE-2021-40904CVE-2021-40904
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
80.3%
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0)
allows a misconfiguration of the web-app Dokuwiki (installed by default),
which allows embedded php code. As a result, remote code execution is
achieved. Successful exploitation requires access to the web management
interface, either with valid credentials or with a hijacked session by a
user with the role of administrator.
Notes
| Author | Note |
|---|---|
| 0xnishit | Remove dokuwiki: https://github.com/tribe29/checkmk/commit/44e4b1a77d3aeee4bc835d3858fcc1bb00b80072 upstream removed the whole module and therefore we won’t be applying a fix |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
80.3%