CVE-2021-40905

high-risk
Published 2022-03-25

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner

Do I need to act?

~
4.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Checkmk Tribe29

References (4)

Product http://checkmk.com
Exploit https://github.com/Edgarloyola/CVE-2021-40905
Product http://checkmk.com
Exploit https://github.com/Edgarloyola/CVE-2021-40905
60
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 8/34 · Low
Exposure 22/34 · High