CVE-2021-40906

Medium · 6.1

CVSS

6.1

EPSS

1.0%

Published

Mar 25, 2022

CISA due date

—

Cloudanix analysis

Unrated SSVC: Track

Some older versions of DNS and monitoring software need updates to address a known issue.

Exploitation: Other
Attacker needs: Other
Complexity: Other
Impact: Other
Component: Other
Class: Other
Remediation: Other
Effort: Other
Patch risk: Other

What it actually does

Insufficient information in the provided CVE details to determine the specific technical effect of the flaw.

Why it matters to the business

Unknown exposure in MaraDNS deployments on Debian and Checkmk installations may require upgrades; low EPSS and no KEV listing indicate limited known urgency but ecosystem prevalence in package managers still necessitates review.

How an attack unfolds

No description or exploitation details are supplied, preventing construction of an attacker scenario; no named threat actors or ransomware usage are indicated.

How to fix it

Upgrade affected packages to the listed fixed versions: maradns on Debian 4.0 to 1.2.12.04-1etch2, maradns on Debian 3.1 to 1.0.27-2, and checkmk to commit d5ccd5ecc956e665aca80f3c486f7fa46f409424.

How to confirm the fix worked

Verify installed package versions against the fixed versions listed for each affected product and confirm no vulnerable releases remain in use.

How to detect it

No exploitation details or threat actor information are available, so no specific historical exploitation artifacts can be identified from the input.

What your security team should do

Apply the exact fixed package versions immediately on all affected systems.
Scan environments for presence of the listed vulnerable package versions.
Monitor EPSS trend (stable at ~0.0099) and reassess if new exploitation data emerges.

The record

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.

Affected packages

Ecosystem	Package	Introduced	Fixed
Ubuntu:18.04:LTS	check-mk	0	1.2.8p16-1ubuntu0.2