CVE-2014-5340

Check_MK < 1.2.4p4 and 1.2.5 < 1.2.5i4 - Remote Code Execution via Pickle Deserialization

Title source: llm
STIX 2.1

Description

The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL.

References (4)

Core 4
Core References
Patch, Vendor Advisory x_refsource_confirm
http://mathias-kettner.de/check_mk_werks.php?werk_id=984
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-1495.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/533180/100/0/threaded

Scores

EPSS 0.0614
EPSS Percentile 92.6%

Details

CWE
CWE-94
Status published
Products (3)
check_mk_project/check_mk 1.2.4 (3 CPE variants)
check_mk_project/check_mk 1.2.5 i1 (3 CPE variants)
check_mk_project/check_mk < 1.2.4
Published Sep 02, 2014
Tracked Since Feb 18, 2026