CVE-2023-34096

MEDIUM

Thruk has Path Traversal Vulnerability in panorama.pm

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-34096 has a selected CVSS score of 6.5 (medium); EIP currently links 1 catalogued exploit.

Description

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 6, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Thruk

Browse sni / Thruk
CVE List< 3.06.2affected

Proofs of concept

1

Catalogued exploits

ExploitDBThruk Monitoring Web Interface 3.06 - Path TraversalExploitDB exploitby Galoget LatorreNot analyzed1 file
ExploitDB
PoC details

References

8