CVE-2024-28826CWE-73

Unrestricted upload and download paths in check_sftp

High · published May 29, 2024

CVSS v3.1
8.8
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00479 · 40.4th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2024-05-29T10:00Z
EPSS history
Timeline
  • 29 MAY 10:00Z
    Unrestricted upload and download paths in check_sftp
    cvelistv5