Vulnerability-Lookup

CVE-2017-14955 (GCVE-0-2017-14955)

Vulnerability from cvelistv5 – Published: 2017-10-01 05:00 – Updated: 2024-08-05 19:42

Summary

Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Assigner

mitre

References

3 references

URL	Tags
https://www.exploit-db.com/exploits/43021/	exploitx_refsource_EXPLOIT-DB
http://mathias-kettner.com/check_mk_werks.php?edi…	x_refsource_CONFIRM
https://mathias-kettner.de/check_mk_werks.php?wer…	x_refsource_CONFIRM

Date Public

2017-10-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:42:22.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "43021",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/43021/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-21T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "43021",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/43021/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14955",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "43021",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/43021/"
            },
            {
              "name": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8",
              "refsource": "CONFIRM",
              "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
            },
            {
              "name": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes",
              "refsource": "CONFIRM",
              "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14955",
    "datePublished": "2017-10-01T05:00:00.000Z",
    "dateReserved": "2017-10-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T19:42:22.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-14955",
      "date": "2026-07-15",
      "epss": "0.12134",
      "percentile": "0.95691"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.3:i6:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C7B318A-D457-4E1F-84B7-D92F18248D4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.3:i7:*:*:*:*:*:*\", \"matchCriteriaId\": \"08E4E9D1-1C3A-4287-8CF1-94694654B901\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.4:b1:*:*:*:*:*:*\", \"matchCriteriaId\": \"163C58C9-1176-4532-9235-FF00BDDE5813\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.5:i1:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CE05BCD-2C6A-4492-9A0F-F6DC38039FD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.5:i2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5AD44A20-C935-421E-84EB-3B6DF32A8A52\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.5:i3:*:*:*:*:*:*\", \"matchCriteriaId\": \"A5D9A1D3-D127-43EB-9C26-541DFC03B2BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.5:i4:*:*:*:*:*:*\", \"matchCriteriaId\": \"90E5A726-1AA7-4C47-92D8-E0DB5B4EEEF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.5:i5:*:*:*:*:*:*\", \"matchCriteriaId\": \"A72D561E-5B99-4A1A-905D-F6E314765D5F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.5:i6:*:*:*:*:*:*\", \"matchCriteriaId\": \"ACDFBEA4-45A2-4438-93F4-A0FF32B5B60F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.6:b1:*:*:*:*:*:*\", \"matchCriteriaId\": \"82FC9CF8-5A45-4FD8-85F8-891A0FEC78F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.6:b2:*:*:*:*:*:*\", \"matchCriteriaId\": \"38568181-E4D6-44E5-BCE3-3CFD96CDB285\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.6:p13:*:*:*:*:*:*\", \"matchCriteriaId\": \"D63191B3-02D4-4C8F-B620-8A57DF0FBB57\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.7:i1:*:*:*:*:*:*\", \"matchCriteriaId\": \"25D907F9-234B-469F-B36F-E378FAF06554\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.7:i1p2:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFB2F75E-A2AE-4C66-93C8-AFC8CEF8BD04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.7:i2:*:*:*:*:*:*\", \"matchCriteriaId\": \"3FDC0157-0B34-4FE2-8A26-89F80A32FC93\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.7:i3:*:*:*:*:*:*\", \"matchCriteriaId\": \"C72153BC-0469-4B8B-ADAC-9056FA4A83E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.7:i4:*:*:*:*:*:*\", \"matchCriteriaId\": \"75E0038E-5789-4DBE-9920-FDB5D5208E2C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.8:p18:*:*:*:*:*:*\", \"matchCriteriaId\": \"2289725D-D71F-4CDA-94DD-409F060948FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:checkmk:checkmk:1.2.8:p25:*:*:*:*:*:*\", \"matchCriteriaId\": \"BFDBA00E-28D5-4366-8431-7BA7B2D3B63C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.\"}, {\"lang\": \"es\", \"value\": \"Check_MK en versiones anteriores a la 1.2.8p26 gestiona de manera incorrecta determinados errores en la caracter\\u00edstica de guardado de intentos fallidos de inicio de sesi\\u00f3n por culpa de una condici\\u00f3n de carrera que permite que los atacantes remotos obtengan informaci\\u00f3n sensible de usuarios leyendo un informe de cierre inesperado de la interfaz gr\\u00e1fica de usuario.\"}]",
      "id": "CVE-2017-14955",
      "lastModified": "2024-11-21T03:13:50.193",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2017-10-02T01:29:00.390",
      "references": "[{\"url\": \"http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8\", \"source\": \"cve@mitre.org\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/43021/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/43021/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}, {\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-14955\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-10-02T01:29:00.390\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.\"},{\"lang\":\"es\",\"value\":\"Check_MK en versiones anteriores a la 1.2.8p26 gestiona de manera incorrecta determinados errores en la caracter\u00edstica de guardado de intentos fallidos de inicio de sesi\u00f3n por culpa de una condici\u00f3n de carrera que permite que los atacantes remotos obtengan informaci\u00f3n sensible de usuarios leyendo un informe de cierre inesperado de la interfaz gr\u00e1fica de usuario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.3:i6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C7B318A-D457-4E1F-84B7-D92F18248D4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.3:i7:*:*:*:*:*:*\",\"matchCriteriaId\":\"08E4E9D1-1C3A-4287-8CF1-94694654B901\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.4:b1:*:*:*:*:*:*\",\"matchCriteriaId\":\"163C58C9-1176-4532-9235-FF00BDDE5813\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.5:i1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CE05BCD-2C6A-4492-9A0F-F6DC38039FD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.5:i2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5AD44A20-C935-421E-84EB-3B6DF32A8A52\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.5:i3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5D9A1D3-D127-43EB-9C26-541DFC03B2BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.5:i4:*:*:*:*:*:*\",\"matchCriteriaId\":\"90E5A726-1AA7-4C47-92D8-E0DB5B4EEEF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.5:i5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A72D561E-5B99-4A1A-905D-F6E314765D5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.5:i6:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACDFBEA4-45A2-4438-93F4-A0FF32B5B60F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.6:b1:*:*:*:*:*:*\",\"matchCriteriaId\":\"82FC9CF8-5A45-4FD8-85F8-891A0FEC78F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.6:b2:*:*:*:*:*:*\",\"matchCriteriaId\":\"38568181-E4D6-44E5-BCE3-3CFD96CDB285\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.6:p13:*:*:*:*:*:*\",\"matchCriteriaId\":\"D63191B3-02D4-4C8F-B620-8A57DF0FBB57\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.7:i1:*:*:*:*:*:*\",\"matchCriteriaId\":\"25D907F9-234B-469F-B36F-E378FAF06554\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.7:i1p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFB2F75E-A2AE-4C66-93C8-AFC8CEF8BD04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.7:i2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FDC0157-0B34-4FE2-8A26-89F80A32FC93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.7:i3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C72153BC-0469-4B8B-ADAC-9056FA4A83E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.7:i4:*:*:*:*:*:*\",\"matchCriteriaId\":\"75E0038E-5789-4DBE-9920-FDB5D5208E2C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.8:p18:*:*:*:*:*:*\",\"matchCriteriaId\":\"2289725D-D71F-4CDA-94DD-409F060948FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:1.2.8:p25:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFDBA00E-28D5-4366-8431-7BA7B2D3B63C\"}]}]}],\"references\":[{\"url\":\"http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/43021/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/43021/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-05-13T01:19:22+00:00",
      "cve": "CVE-2017-14955",
      "id": "CVE-2017-14955",
      "initial_release_date": "2017-09-25T00:00:00+00:00",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "check-mk: Mishandles certain errors within the failed-login save feature because of a race condition",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-14955.json",
      "version": "3"
    }
  }
}

CNVD-2017-32350

Vulnerability from cnvd - Published: 2017-11-02

Title

Mathias Kettner Check_MK信息泄露漏洞

Description

Mathias Kettner Check_MK是德国Mathias Kettner公司的一套开源、通用的Nagios/Icinga（监视系统）数据采集插件，它通过采用新的方法从操作系统和网络组件中收集数据，并支持自动检测主机上的监控项目。 Mathias Kettner Check_MK 1.2.8p26中存在信息泄露漏洞。远程攻击者可通过读取GUI崩溃报告利用该漏洞获取敏感的用户信息。

Severity

中

Patch Name

Mathias Kettner Check_MK 信息泄露漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML;=yes

Reference

http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8 http://www.exploitalert.com/view-details.html?id=27826

Impacted products

Name
Mathias Kettner Check_MK 1.2.8p26

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-14955"
    }
  },
  "description": "Mathias Kettner Check_MK\u662f\u5fb7\u56fdMathias Kettner\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u3001\u901a\u7528\u7684Nagios/Icinga\uff08\u76d1\u89c6\u7cfb\u7edf\uff09\u6570\u636e\u91c7\u96c6\u63d2\u4ef6\uff0c\u5b83\u901a\u8fc7\u91c7\u7528\u65b0\u7684\u65b9\u6cd5\u4ece\u64cd\u4f5c\u7cfb\u7edf\u548c\u7f51\u7edc\u7ec4\u4ef6\u4e2d\u6536\u96c6\u6570\u636e\uff0c\u5e76\u652f\u6301\u81ea\u52a8\u68c0\u6d4b\u4e3b\u673a\u4e0a\u7684\u76d1\u63a7\u9879\u76ee\u3002\r\n\r\nMathias Kettner Check_MK 1.2.8p26\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bfb\u53d6GUI\u5d29\u6e83\u62a5\u544a\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u7684\u7528\u6237\u4fe1\u606f\u3002",
  "discovererName": "Julien Ahrens",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML;=yes",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-32350",
  "openTime": "2017-11-02",
  "patchDescription": "Mathias Kettner Check_MK\u662f\u5fb7\u56fdMathias Kettner\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u3001\u901a\u7528\u7684Nagios/Icinga\uff08\u76d1\u89c6\u7cfb\u7edf\uff09\u6570\u636e\u91c7\u96c6\u63d2\u4ef6\uff0c\u5b83\u901a\u8fc7\u91c7\u7528\u65b0\u7684\u65b9\u6cd5\u4ece\u64cd\u4f5c\u7cfb\u7edf\u548c\u7f51\u7edc\u7ec4\u4ef6\u4e2d\u6536\u96c6\u6570\u636e\uff0c\u5e76\u652f\u6301\u81ea\u52a8\u68c0\u6d4b\u4e3b\u673a\u4e0a\u7684\u76d1\u63a7\u9879\u76ee\u3002\r\n\r\nMathias Kettner Check_MK 1.2.8p26\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bfb\u53d6GUI\u5d29\u6e83\u62a5\u544a\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u7684\u7528\u6237\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Mathias Kettner Check_MK \u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Mathias Kettner Check_MK 1.2.8p26"
  },
  "referenceLink": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8\r\nhttp://www.exploitalert.com/view-details.html?id=27826",
  "serverity": "\u4e2d",
  "submitTime": "2017-10-20",
  "title": "Mathias Kettner Check_MK\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

FKIE_CVE-2017-14955

Vulnerability from fkie_nvd - Published: 2017-10-02 01:29 - Updated: 2026-06-17 01:07

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
cve@mitre.org	http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8	Release Notes, Third Party Advisory
cve@mitre.org	https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes	Third Party Advisory
cve@mitre.org	https://www.exploit-db.com/exploits/43021/	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/43021/	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
checkmk	checkmk	1.2.3
checkmk	checkmk	1.2.3
checkmk	checkmk	1.2.4
checkmk	checkmk	1.2.5
checkmk	checkmk	1.2.5
checkmk	checkmk	1.2.5
checkmk	checkmk	1.2.5
checkmk	checkmk	1.2.5
checkmk	checkmk	1.2.5
checkmk	checkmk	1.2.6
checkmk	checkmk	1.2.6
checkmk	checkmk	1.2.6
checkmk	checkmk	1.2.7
checkmk	checkmk	1.2.7
checkmk	checkmk	1.2.7
checkmk	checkmk	1.2.7
checkmk	checkmk	1.2.7
checkmk	checkmk	1.2.8
checkmk	checkmk	1.2.8

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.3:i6:*:*:*:*:*:*",
              "matchCriteriaId": "9C7B318A-D457-4E1F-84B7-D92F18248D4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.3:i7:*:*:*:*:*:*",
              "matchCriteriaId": "08E4E9D1-1C3A-4287-8CF1-94694654B901",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.4:b1:*:*:*:*:*:*",
              "matchCriteriaId": "163C58C9-1176-4532-9235-FF00BDDE5813",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i1:*:*:*:*:*:*",
              "matchCriteriaId": "5CE05BCD-2C6A-4492-9A0F-F6DC38039FD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i2:*:*:*:*:*:*",
              "matchCriteriaId": "5AD44A20-C935-421E-84EB-3B6DF32A8A52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i3:*:*:*:*:*:*",
              "matchCriteriaId": "A5D9A1D3-D127-43EB-9C26-541DFC03B2BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i4:*:*:*:*:*:*",
              "matchCriteriaId": "90E5A726-1AA7-4C47-92D8-E0DB5B4EEEF4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i5:*:*:*:*:*:*",
              "matchCriteriaId": "A72D561E-5B99-4A1A-905D-F6E314765D5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.5:i6:*:*:*:*:*:*",
              "matchCriteriaId": "ACDFBEA4-45A2-4438-93F4-A0FF32B5B60F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.6:b1:*:*:*:*:*:*",
              "matchCriteriaId": "82FC9CF8-5A45-4FD8-85F8-891A0FEC78F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.6:b2:*:*:*:*:*:*",
              "matchCriteriaId": "38568181-E4D6-44E5-BCE3-3CFD96CDB285",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.6:p13:*:*:*:*:*:*",
              "matchCriteriaId": "D63191B3-02D4-4C8F-B620-8A57DF0FBB57",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i1:*:*:*:*:*:*",
              "matchCriteriaId": "25D907F9-234B-469F-B36F-E378FAF06554",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i1p2:*:*:*:*:*:*",
              "matchCriteriaId": "EFB2F75E-A2AE-4C66-93C8-AFC8CEF8BD04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i2:*:*:*:*:*:*",
              "matchCriteriaId": "3FDC0157-0B34-4FE2-8A26-89F80A32FC93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i3:*:*:*:*:*:*",
              "matchCriteriaId": "C72153BC-0469-4B8B-ADAC-9056FA4A83E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.7:i4:*:*:*:*:*:*",
              "matchCriteriaId": "75E0038E-5789-4DBE-9920-FDB5D5208E2C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.8:p18:*:*:*:*:*:*",
              "matchCriteriaId": "2289725D-D71F-4CDA-94DD-409F060948FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:checkmk:checkmk:1.2.8:p25:*:*:*:*:*:*",
              "matchCriteriaId": "BFDBA00E-28D5-4366-8431-7BA7B2D3B63C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report."
    },
    {
      "lang": "es",
      "value": "Check_MK en versiones anteriores a la 1.2.8p26 gestiona de manera incorrecta determinados errores en la caracter\u00edstica de guardado de intentos fallidos de inicio de sesi\u00f3n por culpa de una condici\u00f3n de carrera que permite que los atacantes remotos obtengan informaci\u00f3n sensible de usuarios leyendo un informe de cierre inesperado de la interfaz gr\u00e1fica de usuario."
    }
  ],
  "id": "CVE-2017-14955",
  "lastModified": "2026-06-17T01:07:02.813",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-10-02T01:29:00.390",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/43021/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/43021/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-8QHG-C9H2-G6RJ

Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2024-07-23 21:31

Details

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-14955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-02T01:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.",
  "id": "GHSA-8qhg-c9h2-g6rj",
  "modified": "2024-07-23T21:31:31Z",
  "published": "2022-05-13T01:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14955"
    },
    {
      "type": "WEB",
      "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/43021"
    },
    {
      "type": "WEB",
      "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2017-14955

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2017-14955

Aliases

CVE-2017-14955

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-14955",
    "description": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.",
    "id": "GSD-2017-14955",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2017-14955",
      "https://ubuntu.com/security/CVE-2017-14955"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-14955"
      ],
      "details": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.",
      "id": "GSD-2017-14955",
      "modified": "2023-12-13T01:21:13.117791Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2017-14955",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "43021",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/43021/"
          },
          {
            "name": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8",
            "refsource": "CONFIRM",
            "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
          },
          {
            "name": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes",
            "refsource": "CONFIRM",
            "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.5:i4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.5:i5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.5:i6:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.6:b1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.5:i1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.5:i3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.6:b2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.7:i1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.7:i2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.3:i6:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.3:i7:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.7:i3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.7:i4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.8:p18:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.8:p25:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.4:b1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.5:i2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.6:p13:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:tribe29:checkmk:1.2.7:i1p2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14955"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-200"
                },
                {
                  "lang": "en",
                  "value": "CWE-362"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
            },
            {
              "name": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8",
              "refsource": "CONFIRM",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
            },
            {
              "name": "43021",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/43021/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2019-10-17T13:21Z",
      "publishedDate": "2017-10-02T01:29Z"
    }
  }
}

ubuntu-cve-2017-14955

Vulnerability from osv_ubuntu

Published

2017-10-02 01:29

Modified

2025-09-08 16:44

Summary

Details

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2017-14955	REPORT
	http://mathias-kettner.com/check_mk_werks.php?edi…	REPORT
	https://mathias-kettner.de/check_mk_werks.php?wer…	REPORT
	http://git.mathias-kettner.de/git/?p=check_mk.git…	REPORT
	https://ubuntu.com/security/notices/USN-5527-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-14955	REPORT
	https://ubuntu.com/security/notices/USN-5527-2	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "check-mk-agent",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          },
          {
            "binary_name": "check-mk-agent-logwatch",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          },
          {
            "binary_name": "check-mk-config-icinga",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          },
          {
            "binary_name": "check-mk-config-nagios3",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          },
          {
            "binary_name": "check-mk-livestatus",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          },
          {
            "binary_name": "check-mk-multisite",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          },
          {
            "binary_name": "check-mk-server",
            "binary_version": "1.2.6p12-1ubuntu0.16.04.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "check-mk",
        "purl": "pkg:deb/ubuntu/check-mk@1.2.6p12-1ubuntu0.16.04.1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.6p12-1ubuntu0.16.04.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.6p5-1",
        "1.2.6p12-1",
        "1.2.6p12-1ubuntu0.16.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "check-mk-agent",
            "binary_version": "1.2.8p16-1ubuntu0.2"
          },
          {
            "binary_name": "check-mk-agent-logwatch",
            "binary_version": "1.2.8p16-1ubuntu0.2"
          },
          {
            "binary_name": "check-mk-config-icinga",
            "binary_version": "1.2.8p16-1ubuntu0.2"
          },
          {
            "binary_name": "check-mk-livestatus",
            "binary_version": "1.2.8p16-1ubuntu0.2"
          },
          {
            "binary_name": "check-mk-multisite",
            "binary_version": "1.2.8p16-1ubuntu0.2"
          },
          {
            "binary_name": "check-mk-server",
            "binary_version": "1.2.8p16-1ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "check-mk",
        "purl": "pkg:deb/ubuntu/check-mk@1.2.8p16-1ubuntu0.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.8p16-1ubuntu0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.8p16-1ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.",
  "id": "UBUNTU-CVE-2017-14955",
  "modified": "2025-09-08T16:44:27Z",
  "published": "2017-10-02T01:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-14955"
    },
    {
      "type": "REPORT",
      "url": "http://mathias-kettner.com/check_mk_werks.php?edition_id=raw\u0026branch=1.2.8"
    },
    {
      "type": "REPORT",
      "url": "https://mathias-kettner.de/check_mk_werks.php?werk_id=5208\u0026HTML=yes"
    },
    {
      "type": "REPORT",
      "url": "http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=a4a2cc1f30ff6032899ca80eed29fa26b8898c54"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5527-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14955"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5527-2"
    }
  ],
  "related": [
    "USN-5527-1",
    "USN-5527-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-14955"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2017-14955 (GCVE-0-2017-14955)

CNVD-2017-32350

FKIE_CVE-2017-14955

GHSA-8QHG-C9H2-G6RJ

GSD-2017-14955

ubuntu-cve-2017-14955

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature