CVE-2021-40905 - CVE House
Back to Database
Status published Unknown CVE-2021-40905

The web management console of CheckMK Enterprise Edition (versions 1.5.0...

Vulnerability Description

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-40905

Credits & Attribution

No credits recorded in the NVD database.

References

More from checkmk

View All →
CVE-2022-33912
A permission issue affects users that deployed the shipped version...
High 7.8
CVE-2022-31258
In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before...
High 8.2
CVE-2022-24566
In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed...
Medium 5.4
CVE-2022-24565
Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in...
Medium 5.4
CVE-2022-24564
Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While...
Medium 6.1

Affected Vendor

Affected Software

checkmk
Vulnerable Versions:
2.0.0, 1.5.0

Timeline

Official Publish: March 25th, 2022
Last Modified: July 9th, 2026
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.