Lucene search

GoogleOSV:CVE-2022-48321

HistoryFeb 20, 2023 - 5:15 p.m.

CVE-2022-48321

2023-02-2017:15:12

Google

osv.dev

cve-2022-48321

server-side request forgery

tribe29 checkmk

api

local network

software

6.8 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

3.9 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29’s Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API.

CPENameOperatorVersion
checkmkeq1.1.5i0
checkmkeq1.1.6
checkmkeq1.2.0b1
checkmkeq1.2.1i3
checkmkeq1.2.5i6
checkmkeq2.1.0b9
checkmkeq1.2.7i3
checkmkeq1.1.8b1
checkmkeq1.5.0i2
checkmkeq2.1.0b5

Name	Operator	Version
checkmk	eq	1.1.5i0
checkmk	eq	1.1.6
checkmk	eq	1.2.0b1
checkmk	eq	1.2.1i3
checkmk	eq	1.2.5i6
checkmk	eq	2.1.0b9
checkmk	eq	1.2.7i3
checkmk	eq	1.1.8b1
checkmk	eq	1.5.0i2
checkmk	eq	2.1.0b5

Rows per page:

1-10 of 931

References

checkmk.com/werk/14385

www.sonarsource.com/blog/checkmk-rce-chain-1/

6.8 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

3.9 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for OSV:CVE-2022-48321