CVE-2021-40905 Information

Description

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of .mkp\ files which are Extension Packages making remote code execution possible. Successful exploitation requires access to the web management interface either with valid credentials or with a hijacked session of a user with administrator role.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

http://checkmk.com https://github.com/Edgarloyola/CVE-2021-40905

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8