CVE-2022-37298

2022-10-2000:00:00

ubuntu.com

shinken

monitoring

vulnerable

incorrect access control

safeunpickler

authentication scheme

unserialization

objects

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

57.3%

JSON

Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable
to Incorrect Access Control. The SafeUnpickler class found in
shinken/safepickle.py implements a weak authentication scheme when
unserializing objects passed from monitoring nodes to the Shinken
monitoring server.