CVE-2022-48319

2023-02-2017:15:12

Google

osv.dev

checkmk

host secret

disclosure

unprotected file

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29’s Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file.

CPENameOperatorVersion
checkmkeq2.0.0b3
checkmkeq1.1.5i0
checkmkeq1.1.6
checkmkeq1.2.0b1
checkmkeq2.0.0b5
checkmkeq1.2.1i3
checkmkeq1.2.5i6
checkmkeq2.1.0b9
checkmkeq1.2.7i3
checkmkeq1.1.8b1

Name	Operator	Version
checkmk	eq	2.0.0b3
checkmk	eq	1.1.5i0
checkmk	eq	1.1.6
checkmk	eq	1.2.0b1
checkmk	eq	2.0.0b5
checkmk	eq	1.2.1i3
checkmk	eq	1.2.5i6
checkmk	eq	2.1.0b9
checkmk	eq	1.2.7i3
checkmk	eq	1.1.8b1