CVE-2023-34409: In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL…

PriorityP357critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.28%

66.4th percentile

In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
percona	monitoring_and_management	>= 2.0.0 < 2.37.1	2.37.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.