CVE-2014-2330
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or…
Does this matter?
Lower severity and a low EPSS score (1.14%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown vectors.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- check mk project/check mk
- Source
- cve@mitre.org
References
- http://mathias-kettner.de/check_mk_werks.php?werk_id=0766Vendor Advisory
- http://www.securityfocus.com/archive/1/531594
- http://www.securityfocus.com/bid/66389
- http://mathias-kettner.de/check_mk_werks.php?werk_id=0766Vendor Advisory
- http://www.securityfocus.com/archive/1/531594
- http://www.securityfocus.com/bid/66389
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.