Threats tagged 'ghsa-p25x-4jr8-p5mr'

A critical argument injection vulnerability exists in the Kubernetes special agent component of Checkmk versions prior to 2.5.0p19, 2.4.0p40, and in the end-of-life 2.3.0 version. This flaw allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user by crafting node roles in the "Exclude nodes based on their role" rule option. Successful exploitation leads to code execution with the privileges of the site user.