CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22318 – Denial of service against webconf
https://notcve.org/view.php?id=CVE-2023-22318
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. • https://checkmk.com/werk/9526 • CWE-412: Unrestricted Externally Accessible Lock CWE-667: Improper Locking •
CVSS: 5.5EPSS: 0%CPEs: 86EXPL: 0CVE-2023-31207 – Automation user secret logged to Apache access log
https://notcve.org/view.php?id=CVE-2023-31207
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log. • https://checkmk.com/werk/15189 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.8EPSS: 0%CPEs: 89EXPL: 0CVE-2022-46302 – Remote Code Execution with Root Privileges via Broad Apache Permissions
https://notcve.org/view.php?id=CVE-2022-46302
Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host. • https://checkmk.com/werk/14281 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22309 – Reflected Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-22309
Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4. • https://checkmk.com/werk/9523 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22294 – Privilege escalation in Checkmk Appliance
https://notcve.org/view.php?id=CVE-2023-22294
Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. • https://checkmk.com/werk/9520 • CWE-732: Incorrect Permission Assignment for Critical Resource •