CVE-2023-34096
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Thruk versions 3.06 and prior are vulnerable to a Path Traversal attack in the `panorama.pm` file, allowing an attacker to upload files to any folder with write permissions. The location parameter is not filtered or validated.
Risk Assessment
An attacker could exploit this vulnerability to upload malicious files, potentially leading to system compromise or data leakage. Organizations should be aware of the risks associated with unauthorized access to the system.
Recommendation
It is recommended to update Thruk to version 3.06.2 or later to mitigate this vulnerability. A permissions audit of folders on the system should also be conducted.
Original NVD description (English source)
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.