CVE catalog
CVE-2017-6188
munin: CVE-2017-6188
- Severity
- Medium · CVSS 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.42% · Oct 25, 2026
Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file accessible to the www-data user.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | munin | sid | 2.0.78-2 | fixed |
| Debian | munin | forky | 2.0.78-2 | fixed |
| Debian | munin | trixie | 2.0.76-5 | fixed |
| Debian | munin | bookworm | 2.0.73-1 | fixed |
| Ubuntu | munin | 14.04 | 2.0.17-2ubuntu1 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.17-3ubuntu1 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.18-1ubuntu1 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.19-2 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.19-3 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.19-3ubuntu0.2 | fixed |
| Opensuse | munin | tumbleweed | 2.0.66-3.5 | fixed |
| Ubuntu | munin | 14.04 | 2.0.17-2ubuntu1 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.17-3ubuntu1 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.18-1ubuntu1 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.19-2 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.19-3 | vulnerable |
| Ubuntu | munin | 14.04 | 2.0.19-3ubuntu0.2 | fixed |
| Ubuntu | munin | 16.04 | 2.0.25-1 | vulnerable |
| Ubuntu | munin | 16.04 | 2.0.25-2 | vulnerable |
| Ubuntu | munin | 16.04 | 2.0.25-2ubuntu0.16.04.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | munin | source | sid | 2.0.31-1 | not yet assigned | Not reported | [855705] |
| Debian | munin | source | forky | 2.0.31-1 | not yet assigned | Not reported | [855705] |
| Debian | munin | source | trixie | 2.0.31-1 | not yet assigned | Not reported | [855705] |
| Debian | munin | source | bookworm | 2.0.31-1 | not yet assigned | Not reported | [855705] |
| Ubuntu | munin | deb | 14.04 | 2.0.19-3ubuntu0.2 | Not reported | USN-3215-1 | Not reported |
| Opensuse | munin | rpm | tumbleweed | 2.0.66-3.5 | Not reported | OPENSUSE-SU-2024:11067-1 | Not reported |
| Ubuntu | munin | deb | 14.04 | 2.0.19-3ubuntu0.2 | Not reported | UBUNTU-CVE-2017-6188 | Not reported |
| Ubuntu | munin | deb | 16.04 | 2.0.25-2ubuntu0.16.04.2 | Not reported | UBUNTU-CVE-2017-6188 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [munin-node]Unknown
Source package: [munin]
Details (1)
2.0.75-1.5· noarch · tumbleweedUnknown · Fixed:
2.0.66-3.5Version impact unknown
dsa · munin · opensuse · tumbleweed
- [munin]Fixed
Source package: [munin]
Details (1)
2.0.75-1.5· noarch · tumbleweedFixed · Fixed:
2.0.66-3.5dsa · munin · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [munin]Fixed
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-async]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-common]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-doc]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-node]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-plugins-core]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-plugins-extra]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
- [munin-plugins-java]Fixed
Source package: [munin]
Details (4)
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.73-1· all · bookwormFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
2.0.76-1~bpo12+1· all · bookworm-backportsFixed · Fixed:
2.0.31-1dsa · munin · debian · bookworm; dsa · munin · debian · 12
[Debian 13 (Trixie)]
- [munin]Fixed
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-async]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-common]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-doc]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-node]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-plugins-core]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-plugins-extra]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
- [munin-plugins-java]Fixed
Source package: [munin]
Details (2)
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
2.0.76-5· all · trixieFixed · Fixed:
2.0.31-1dsa · munin · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11067-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-6188]
- [https://osv.dev/vulnerability/DLA-836-1]
- [https://osv.dev/vulnerability/DSA-3794-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2017-6188]
- [https://osv.dev/vulnerability/USN-3215-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11067-1]
- [https://security-tracker.debian.org/tracker/CVE-2017-6188]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]