CVE-2022-4884 Path-Traversal in MKP storing

2023-01-0916:11:16

CWE-22

Tribe29

www.cve.org

cve-2022-4884

path-traversal

mkp

tribe29 checkmk

arbitrary locations

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Checkmk",
    "vendor": "Tribe29",
    "versions": [
      {
        "lessThanOrEqual": "2.0.0p32",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "2.1.0p18",
        "status": "affected",
        "version": "2.1.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.6.0p30",
        "status": "unaffected",
        "version": "1.6.0",
        "versionType": "semver"
      }
    ]
  }
]