Vulnerability · Published Jun 8, 2023 · Assigned by GitHub_M

CVE-2023-34096Thruk has Path Traversal Vulnerability in panorama.pm

Medium 6.5

In plain English

A medium-severity path traversal in Thruk from sni. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 62.7% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)62.7%top 0.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.

Affected products (as reported)

Vendor	Product	Versions
sni	Thruk	< 3.06.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

In plain English

Official description

Affected products (as reported)

References