CVE-2021-40905

HighCVSS 8.8/10Last modified Jul 9, 2026

Description

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 25, 2022
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-409066.1CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated CVE-2021-409079.8SQL injection vulnerability in Sourcecodester Storage Unit Rental Management System v1 by oretnom23, allows attackers to execute arbitrary SCVE-2021-409089.8SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows attackers to execute arbCVE-2021-409099.6Cross site scripting (XSS) vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom2CVE-2021-40917.5A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series ofCVE-2021-409106.1There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.CVE-2021-40924.3yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-409216.1Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitCVE-2021-409226.1Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web CVE-2021-409236.1Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web CVE-2021-409246.1Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web CVE-2021-409256.1Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject a