{"id":"CVE-2022-37298","aliases":["EUVD-2022-7139","GHSA-p373-jqfm-j6wr","PYSEC-2026-540"],"status":"published","title":"Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03056,"percentile":0.87699,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2022-10-20T00:00:00Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"pocgithub","id":"dbyio/cve-2022-37298","title":"dbyio/cve-2022-37298","date":"2022-10-13","url":"https://github.com/dbyio/cve-2022-37298"}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"shinken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"shinken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.3"}]}],"versions":["2.0","2.0.1","2.0.2","2.0.3","2.2","2.4","2.4.2","2.4.3"]},{"source":"osv","ecosystem":"PyPI","package":"shinken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.3"}]}],"versions":["2.0","2.0.1","2.0.2","2.0.3","2.2","2.4","2.4.2","2.4.3"]}],"products":[{"vendor":"shinken-monitoring","product":"shinken_monitoring"}],"references":[{"url":"https://github.com/naparuba/shinken/commit/2dae40fd1e713aec9e1966a0ab7a580b9180cff2","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/dbyio/cve-2022-37298","tags":["x_transferred","Patch","Third Party Advisory","package","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37298","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p373-jqfm-j6wr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37298.json","tags":["advisory"]},{"url":"https://github.com/naparuba/shinken","tags":["package"]},{"url":"https://pypi.org/project/shinken","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-37298","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2022-10-20T00:00:00Z","modified":"2025-05-08T15:54:56.495Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-7139","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2022-10-20T00:00:00Z","modified":"2025-05-08T15:54:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:51.637681Z"}],"ghsa":[{"id":"GHSA-p373-jqfm-j6wr","title":"Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The `SafeUnpickler` class found in `shinken/safepickle.py` implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2022-10-20T12:00:15Z","modified":"2023-08-17T05:02:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2022-37298","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2022-10-20T11:15:10.38Z","modified":"2026-06-17T04:54:50.113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"CVE-2022-37298","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2022-10-20T00:00:00Z","modified":"2026-10-28T02:31:14.363297539Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-p373-jqfm-j6wr","title":"Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The `SafeUnpickler` class found in `shinken/safepickle.py` implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2022-10-20T12:00:15Z","modified":"2026-06-29T12:26:45.803130026Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"PYSEC-2026-540","title":"Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control","description":"Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The `SafeUnpickler` class found in `shinken/safepickle.py` implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.","status":"published","published":"2026-06-29T11:50:33.392933Z","modified":"2026-07-01T20:23:05.025809Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}