CVSS: 8.0EPSS: 0%CPEs: 99EXPL: 0CVE-2022-46303 – Command injection in SMS notifications
https://notcve.org/view.php?id=CVE-2022-46303
Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions. • https://checkmk.com/werk/14381 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 86EXPL: 0CVE-2022-43440 – Privilege escalation via manipulated unixcat executable
https://notcve.org/view.php?id=CVE-2022-43440
Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable • https://checkmk.com/werk/14087 • CWE-427: Uncontrolled Search Path Element •
CVSS: 8.1EPSS: 0%CPEs: 71EXPL: 0CVE-2023-0284 – Improper validation of LDAP user IDs
https://notcve.org/view.php?id=CVE-2023-0284
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected. La validación de entrada incorrecta de las ID de usuario LDAP en Tribe29 Checkmk permite a los atacantes que pueden controlar las ID de usuario LDAP manipular archivos en el servidor. Esta vulnerabilidad afecta a las versiones Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32 y todas las versiones de Checkmk 1.6.0 (EOL). • https://checkmk.com/werk/15181 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 71EXPL: 0CVE-2022-33912
https://notcve.org/view.php?id=CVE-2022-33912
A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the user and the group with ID 1001. If such a user exists on the system, they can change the content of these files (which are then executed by root). This leads to a local privilege escalation on the monitored host. • https://checkmk.com/werk/14098 • CWE-276: Incorrect Default Permissions •
CVSS: 8.2EPSS: 0%CPEs: 88EXPL: 0CVE-2022-31258
https://notcve.org/view.php?id=CVE-2022-31258
In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink. En Checkmk versiones anteriores a 1.6.0p29, 2.x anteriores a 2.0.0p25, y 2.1.x anteriores a 2.1.0b10, un usuario del sitio puede escalar a root editando un enlace simbólico del hook OMD • https://checkmk.com/werk/13902 https://forum.checkmk.com/c/announcements/18 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •