What is the CVSS score of CVE-2014-2332?

CVE-2014-2332 has a CVSS 2.0 base score of 5.5 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:N/I:P/A:P. EPSS exploitation probability: 0.4%.

Check Mk CVE-2014-2332

MEDIUM

Improper Input Validation (CWE-20)

2015-08-31 cve@mitre.org

Information Disclosure Check Mk

5.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/Au:S/C:N/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:N/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

Lifecycle Timeline

CVE Published

Aug 31, 2015 - 18:59 cve.org

MEDIUM 5.5

DescriptionCVE.org

Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

AnalysisAI

Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References.". Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330. Affected products include: Check Mk Project Check Mk. Version information: before 1.2.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.