CVE-2023-34096mediumCWE-22

CVE-2023-34096: medium-severity vulnerability in sni Thruk

Thruk has Path Traversal Vulnerability in panorama.pm

Published · Updated

Follow this CVE+ Monitor Thruk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

45Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 63%
from disclosure to weapon1 day
Published on NVDJun 8
1st PoC+1d
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
sni · Thruk
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sni Thruk

In the same product, most dangerous first.

CVE-2024-23822MEDIUMThruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)EPSS 1.4%CVE-2024-39915CRITICALAuthenticated remote code execution in ThrukEPSS 0.6%