PatchTheCVEmunin vulnerabilities and fixes
Recent CVEs affecting munin, with upgrade or downgrade steps. 10 tracked.
munin has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2020-01-24. Highest priority: CVE-2012-3513 (score 64/100).
- CVE-2019-3694 HIGH 7.7 UPGRADE UPGRADE A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 all
- CVE-2017-6188 MEDIUM 5.5 UPGRADE MITIGATE Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled
- CVE-2013-6359 MEDIUM 4.3 UPGRADE Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data co
- CVE-2013-6048 MEDIUM 5.0 UPGRADE The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to ca
- CVE-2012-4678 MEDIUM 5.0 DOWNGRADE munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a de
- CVE-2012-3513 HIGH 9.3 UPGRADE munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to l
- CVE-2012-3512 HIGH 7.2 UPGRADE Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root
- CVE-2012-2147 MEDIUM 5.0 DOWNGRADE munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service (disk or memory consumpt
- CVE-2012-2104 MEDIUM 6.8 DOWNGRADE cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, wh
- CVE-2012-2103 LOW 1.2 DOWNGRADE The qmailscan plugin for Munin 1.4.5 allows local users to overwrite arbitrary files via a symlink attack on t
FAQ
How do I fix munin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is munin being exploited right now?
None of the tracked munin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which munin CVE should I patch first?
CVE-2012-3513 currently ranks highest (64/100): munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to l.