medium5.9Public exploit code
CVE-2017-14955
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain se…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Check_MK 1.2.8p25 - Information Disclosure2017-10-18 · webapps · python
Impact
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Checkmk | Checkmk | Versions 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8
- https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes
- https://www.exploit-db.com/exploits/43021/
- http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8
- https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes
- https://www.exploit-db.com/exploits/43021/