CVE-2014-5340: Code Injection
The wato component in CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2014-5340?
CVE-2014-5340 is a vulnerability in the wato component of Check_MK that allows remote code execution due to unsafe use of the pickle Python module.
What is the severity of CVE-2014-5340?
CVE-2014-5340 has a high severity rating due to its potential for remote code execution.
How can I fix CVE-2014-5340?
To fix CVE-2014-5340, upgrade Check_MK to version 1.2.4p4 or 1.2.5i4 or later.
Which versions of Check_MK are affected by CVE-2014-5340?
Versions of Check_MK from 1.2.4 up to and including 1.2.4p3 and 1.2.5 up to 1.2.5i3 are affected by CVE-2014-5340.
What type of attack does CVE-2014-5340 facilitate?
CVE-2014-5340 facilitates remote code execution attacks by allowing attackers to send a crafted serialized object.