CVE-2022-47909

2023-02-2017:15:12

Google

osv.dev

cve-2022-47909

lql injection

authuser http query

tribe29

checkmk 2.1.0p11

checkmk 2.0.0p28

checkmk 1.6.0 (eol)

localhost.

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29’s Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application’s core from localhost.

CPENameOperatorVersion
checkmkeq2.0.0b3
checkmkeq1.1.5i0
checkmkeq1.1.6
checkmkeq1.2.0b1
checkmkeq2.0.0b5
checkmkeq1.2.1i3
checkmkeq1.2.5i6
checkmkeq2.1.0b9
checkmkeq1.2.7i3
checkmkeq1.1.8b1

Name	Operator	Version
checkmk	eq	2.0.0b3
checkmk	eq	1.1.5i0
checkmk	eq	1.1.6
checkmk	eq	1.2.0b1
checkmk	eq	2.0.0b5
checkmk	eq	1.2.1i3
checkmk	eq	1.2.5i6
checkmk	eq	2.1.0b9
checkmk	eq	1.2.7i3
checkmk	eq	1.1.8b1