Checkmk 安全漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk version 2.1.0p11 and earlier, version 2.0.0p28 and earlier, and version 1.6.0. An attacker exploits the vulnerability to obtain sensitive information...

Checkmk 代码问题漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk version 2.1.0p10 and earlier, version 2.0.0p28 and earlier, which stems from failing to securely terminate expired sessions in RestAPI. An attacker could exploit the vulnerability to use an expired session token when...

Checkmk 安全漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk version 2.1.0p13 and earlier, version 2.0.0p29 and earlier, which stems from incorrect authorization controls. An attacker could exploit the vulnerability to obtain sensitive information...

Checkmk 日志信息泄露漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk version 2.1.0p13 and earlier, version 2.0.0p29 and earlier, and version 1.6.0. An attacker can exploit the vulnerability to update the program log file...

Checkmk 跨站请求伪造漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk version 2.1.0p17 and earlier, version 2.0.0p31 and earlier, and version 1.6.0. An attacker could exploit this vulnerability to perform a cross-site request forgery attack, which could add new visual elements to multiple page...

Checkmk 代码问题漏洞

Checkmk is an editor. A security vulnerability exists in Tribe29 Checkmk version 2.1.0p11 and prior versions, which stems from the discovery of a server-side request forgery vulnerability contained in the proxy receiver...

PT-2023-15696 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 1.6.0 and earlier Checkmk versions 2.0.0 through 2.0.0p29 Checkmk versions 2.1.0 through 2.1.0p13 Description: A sensitive host secret is disclosed in the cmk-update-agent.log file, allowing an attacker to gain access to the...

PT-2023-15698 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 1.6.0 and earlier Checkmk versions 2.0.0 through 2.0.0p31 Checkmk versions 2.1.0 through 2.1.0p17 Description: The issue allows an attacker to perform Cross-site Request Forgery CSRF attacks, enabling them to add new visual...

PT-2023-15699 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.1.0 through 2.1.0p11 Description: The issue allows an attacker to perform a limited Server-Side Request Forgery SSRF in the agent-receiver component, enabling communication with local network restricted endpoints through th...

PT-2023-15694 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.0.0p1 through 2.0.0p28 Checkmk versions 2.1.0p1 through 2.1.0p10 Description: The issue arises from the insecure termination of expired sessions in the RestAPI, allowing an attacker to utilize expired session tokens for...

CVE-2022-48319: Exposure of Sensitive Information to an Unauthorized Actor

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk = 2.1.0p13, Checkmk = 2.0.0p29, and all versions of Checkmk 1.6.0 EOL allows an attacker to gain access to the host secret through the unprotected agent updater log file...

CVE-2022-47909: Improper Input Validation

Livestatus Query Language LQL injection in the AuthUser HTTP query header of Tribe29's Checkmk = 2.1.0p11, Checkmk = 2.0.0p28, and all versions of Checkmk 1.6.0 EOL allows an attacker to perform direct queries to the application's core from localhost...

CVE-2022-48320: Cross-Site Request Forgery (CSRF)

Cross-site Request Forgery CSRF in Tribe29's Checkmk = 2.1.0p17, Checkmk = 2.0.0p31, and all versions of Checkmk 1.6.0 EOL allow an attacker to add new visual elements to multiple pages...

PT-2023-15068 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 1.6.0 through 1.6.0p29 Checkmk versions 2.0.0 through 2.0.0p27 Checkmk versions 2.1.0 through 2.1.0p10 Description: The issue allows an attacker to inject and execute PHP code in the auth.php and hosttags.php files of the...

CVE-2022-48317: Insufficient Session Expiration

Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk = 2.1.0p10 and Checkmk = 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI...

CVE-2022-48318: Missing Authorization

No authorisation controls in the RestAPI documentation for Tribe29's Checkmk = 2.1.0p13 and Checkmk = 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation...

CVE-2022-46303: Improper Input Validation

Command injection in SMS notifications in Tribe29 Checkmk = 2.1.0p10, Checkmk = 2.0.0p27, and Checkmk = 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local...

CVE-2022-48321: Improper Input Validation

Limited Server-Side Request Forgery SSRF in agent-receiver in Tribe29's Checkmk = 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API...

CVE-2022-46836: Improper Input Validation

PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk = 2.1.0p10, Checkmk = 2.0.0p27, and Checkmk = 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component...

PT-2023-14900 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 1.6.0 through 1.6.0p29 Checkmk versions 2.0.0 through 2.0.0p27 Checkmk versions 2.1.0 through 2.1.0p10 Description: The issue allows an attacker with User Management permissions, as well as LDAP administrators in certain...