CVE-2023-34096

Description

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.

Weakness classification

• security-advisories@github.com: CWE-22

Primary references

• security-advisories@github.com — Exploit, Third Party Advisory, VDB Entry
• security-advisories@github.com
• security-advisories@github.com
• security-advisories@github.com — Exploit
• security-advisories@github.com — Exploit
• security-advisories@github.com — Exploit
• security-advisories@github.com — Exploit
• security-advisories@github.com — Patch
• security-advisories@github.com — Patch
• security-advisories@github.com — Exploit, Vendor Advisory
• security-advisories@github.com
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry