CVE-2023-34409

CVE-2023-34409 is a critical path traversal vulnerability affecting Percona Monitoring and Management (PMM) server versions 2.x prior to 2.37.1. An unauthenticated remote attacker can exploit this flaw by sending a crafted POST request to unauthenticated API routes, bypassing security controls. This allows for unauthorized access to protected API routes, leading to privilege escalation and sensitive information disclosure, as reflected by its CVSS score of 9.8 (CRITICAL). While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating potential interest from threat actors.