8.8
CVSSv3

CVE-2023-34096

Published: 08/06/2023 Updated: 21/11/2024

Vulnerability Summary

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an malicious user to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.

Vulnerable Product Search on Vulmon Subscribe to Product

thruk thruk

Vendor Advisories

Check Point Reference: CPAI-2023-1643 Date Published: 11 Apr 2024 Severity: High ...

Exploits

Thruk Monitoring Web Interface versions 306 and below are affected by a path traversal vulnerability ...

Github Repositories

Thruk Monitoring Web Interface <= 3.06 vulnerable to CVE-2023-34096 (Path Traversal).

Thruk-CVE-2023-34096 Thruk Monitoring Web Interface versions &lt;= v306 are vulnerable to CVE-2023-34096 (Path Traversal) The current exploit is made in Python 3 and exploits the vulnerability to upload a PoC file to multiple Thruk's common folders and also some Linux folders CVSS The CNA GitHub, Inc assigned a CVSS 31 Score of 65 (Medium) to this finding (Check