Threats tagged 'ghsa-gx39-fx9h-w86g'

A race condition in Checkmk Windows agent versions prior to 2.5.0p18, 2.4.0p39, and 2.3.0p52 causes incorrect permissions on the agent's data directory. This flaw allows a local user to execute arbitrary code with SYSTEM privileges by placing scripts in the agent's plugins or local folders. Additionally, the vulnerability enables reading the agent controller's private key. The affected 2.2.0 version is end-of-life. The issue arises because permission changes are discarded during service start due to the race condition.