CVE-2022-46302

Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk = 2.1.0p6, Checkmk = 2.0.0p27, and all versions of Checkmk 1.6.0 EOL allowing an attacker to perform remote code execution wi...

Cross site scripting

Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4...

CVE-2022-46302 Remote Code Execution with Root Privileges via Broad Apache Permissions

Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk = 2.1.0p6, Checkmk = 2.0.0p27, and all versions of Checkmk 1.6.0 EOL allowing an attacker to perform remote code execution wi...

CVE-2023-22309 Reflected Cross Site Scripting (XSS)

Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4...

CVE-2023-22309 Reflected Cross Site Scripting (XSS)

Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4...

CVE-2023-22309

CVE-2023-22309 describes a reflective XSS in Webconf of the Tribe29 Checkmk Appliance prior to version 1.6.4. The issue stems from inadequate input filtering/escaping in Webconf, enabling a crafted payload to impact web pages. Affected product: Tribe29 Checkmk Appliance (Webconf component); affec...

PT-2023-18417 · Tribe29 · Tribe29 Checkmk Appliance

Name of the Vulnerable Software and Affected Versions: Tribe29 Checkmk Appliance versions prior to 1.6.4 Description: The issue is related to Reflective Cross-Site-Scripting in Webconf. Recommendations: For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue...

CVE-2023-22309: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4...

CVE-2023-22307

Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files...

CVE-2023-22294

Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions...

UBUNTU-CVE-2023-22307

Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files...

UBUNTU-CVE-2023-22294

Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions...

CVE-2023-2020

Insufficient permission checks in the REST API in Tribe29 Checkmk = 2.1.0p27 and = 2.2.0b4 beta allow unauthorized users to schedule downtimes for any host...

Design/Logic Flaw

Insufficient permission checks in the REST API in Tribe29 Checkmk = 2.1.0p27 and = 2.2.0b4 beta allow unauthorized users to schedule downtimes for any host...

CVE-2023-2020

Insufficient permission checks in the REST API in Tribe29 Checkmk = 2.1.0p27 and = 2.2.0b4 beta allow unauthorized users to schedule downtimes for any host...

CVE-2023-2020 Unauthorized scheduling of downtimes via REST API

Insufficient permission checks in the REST API in Tribe29 Checkmk = 2.1.0p27 and = 2.2.0b4 beta allow unauthorized users to schedule downtimes for any host...

CVE-2023-22307: Exposure of Sensitive Information to an Unauthorized Actor

Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files...

CVE-2023-2020: Improper Handling of Insufficient Permissions or Privileges

Insufficient permission checks in the REST API in Tribe29 Checkmk = 2.1.0p27 and = 2.2.0b4 beta allow unauthorized users to schedule downtimes for any host...

CVE-2023-22294: Incorrect Permission Assignment for Critical Resource

Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions...

Checkmk 安全漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk that stems from insufficient REST API permission checking, which allows an attacker to schedule downtime for any host. Affected products and versions: Tribe29 Checkmk 2.1.0p27 and earlier, 2.2.0b4 beta and earlier...