« Volver al listado

CVE-2014-5340

Estado: ModificadaAlta (9.3)—

The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Check MK Project — Check MK

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-5340",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-09-02T14:55:03.683",
  "references": [
    {
      "url": "http://mathias-kettner.de/check_mk_werks.php?werk_id=984",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/127941/Deutsche-Telekom-CERT-Advisory-DTC-A-20140820-001.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1495.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533180/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://mathias-kettner.de/check_mk_werks.php?werk_id=984",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/127941/Deutsche-Telekom-CERT-Advisory-DTC-A-20140820-001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1495.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533180/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL."
    },
    {
      "lang": "es",
      "value": "El componente wato en Check_MK anterior a 1.2.4p4 y 1.2.5 anterior a 1.2.5i4 utiliza el módulo pickle Python de forma insegura, lo que permite a atacantes remotos ejecutar código arbitrario a través de un objeto serializado manipulado, relacionado con una URL de automatización."
    }
  ],
  "lastModified": "2026-06-17T00:11:24.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:*:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "831B5297-24A3-48DD-8024-A36FA8D68E26",
              "versionEndIncluding": "1.2.4"
            },
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95436742-D5D2-4C8C-BCBE-9207659D97ED"
            },
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:1.2.4:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B7019F5-4E38-4895-803F-842F6EEBD5A7"
            },
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:1.2.4:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44880FB1-1E99-426D-8D28-9B2E09395C91"
            },
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:1.2.5:i1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A465E402-D401-45F5-AC00-5214E71D7BB4"
            },
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:1.2.5:i2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F6664A0-4615-4EA3-A5DF-B9846BEFF4D0"
            },
            {
              "criteria": "cpe:2.3:a:check_mk_project:check_mk:1.2.5:i3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD84DD11-025A-4404-A6F9-94D4431F315C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}