Checkmk werks security August 2022

checkmk-werks-sec@lists.checkmk.com

1 participants
1 discussions

Checkmk Werk 14291: NagVis: Updated to 1.9.34 (Fix security issues)

by Lars Michelsen

ID: 14291 Title: NagVis: Updated to 1.9.34 (Fix security issues) Component: Other Components Level: 1 Class: Security fix Version: 2.2.0i1 This update of NagVis fixes the following security issues: 1. Fix SSRF (triggerable by admin users) An administrative user with access to the global options, could perform a server-side request forgery. CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L (8.2) 2. Fix arbitrary file read An authenticated attacker can read arbitrary files with the permissions of the web server user. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L (9.1) 3. Fix type juggling vulnerability in cookie hash processing An attacker could bypass the authentication and gain access to the NagVis component of checkmk. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (3.7)

1 year, 8 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

Checkmk werks security August 2022