CVE-2017-14955 Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI...
MediumCVSS 5.9
EPSS 12.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Checkmk GmbH Checkmk | = 1.2.3-i6 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.3-i7 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.4-b1 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.5-i1 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.5-i2 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.5-i3 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.5-i4 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.5-i5 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.5-i6 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.6-b1 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.6-b2 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.6-p13 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.7-i1 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.7-i1p2 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.7-i2 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.7-i3 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.7-i4 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.8-p18 | No fix listed |
| Checkmk GmbH Checkmk | = 1.2.8-p25 | No fix listed |
References
- mathias-kettner.com release-notes third-party-advisory
- mathias-kettner.de third-party-advisory
- 43021 exploit third-party-advisory vdb-entry