CVE-2017-14955
Estado: ModificadaMedia (5.9)—💥 Exploit
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 5.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 12%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Publicado en Exploit-DB · Check_MK 1.2.8p25 - Information Disclosure (18/10/2017)
Tecnologías afectadas (1)
CWE
- CWE-200, CWE-362
Referencias
- http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8
- https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes
- https://www.exploit-db.com/exploits/43021/
- http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8
- https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes
- https://www.exploit-db.com/exploits/43021/
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-14955",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.9,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-10-02T01:29:00.390",
"references": [
{
"url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.exploit-db.com/exploits/43021/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/43021/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report."
},
{
"lang": "es",
"value": "Check_MK en versiones anteriores a la 1.2.8p26 gestiona de manera incorrecta determinados errores en la característica de guardado de intentos fallidos de inicio de sesión por culpa de una condición de carrera que permite que los atacantes remotos obtengan información sensible de usuarios leyendo un informe de cierre inesperado de la interfaz gráfica de usuario."
}
],
"lastModified": "2026-06-17T01:07:02.813",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.3:i6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C7B318A-D457-4E1F-84B7-D92F18248D4C"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.3:i7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08E4E9D1-1C3A-4287-8CF1-94694654B901"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.4:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "163C58C9-1176-4532-9235-FF00BDDE5813"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CE05BCD-2C6A-4492-9A0F-F6DC38039FD6"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AD44A20-C935-421E-84EB-3B6DF32A8A52"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5D9A1D3-D127-43EB-9C26-541DFC03B2BD"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90E5A726-1AA7-4C47-92D8-E0DB5B4EEEF4"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A72D561E-5B99-4A1A-905D-F6E314765D5F"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACDFBEA4-45A2-4438-93F4-A0FF32B5B60F"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.6:b1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82FC9CF8-5A45-4FD8-85F8-891A0FEC78F4"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.6:b2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38568181-E4D6-44E5-BCE3-3CFD96CDB285"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.6:p13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D63191B3-02D4-4C8F-B620-8A57DF0FBB57"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25D907F9-234B-469F-B36F-E378FAF06554"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i1p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EFB2F75E-A2AE-4C66-93C8-AFC8CEF8BD04"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3FDC0157-0B34-4FE2-8A26-89F80A32FC93"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C72153BC-0469-4B8B-ADAC-9056FA4A83E3"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "75E0038E-5789-4DBE-9920-FDB5D5208E2C"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.8:p18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2289725D-D71F-4CDA-94DD-409F060948FF"
},
{
"criteria": "cpe:2.3:a:checkmk:checkmk:1.2.8:p25:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFDBA00E-28D5-4366-8431-7BA7B2D3B63C"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}