CVE-2017-6188

Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file accessible to the www-data user.

References

Affected packages

Git / github.com/munin-monitoring/munin

Affected ranges

Type: GIT
Repo: https://github.com/munin-monitoring/munin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

3757f16bf453f172ca750403156029563405e840

Introduced

7d5499100e2e67863992e0ab4b484458cb1d6b5e

Fixed

05686a7a5c1c880cd7d3e4d15bb524930aa3798a

Affected versions

2.*

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.30.1

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

2.0.37

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.6.1

2.1.7

2.1.8

2.1.9

2.99.1

2.99.2

2.99.3

2.999.1

2.999.2

2.999.3

2.999.4

2.999.5

2.999.6

2.999.7

2.999.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6188.json"