CVSS: 8.8EPSS: 0%CPEs: 90EXPL: 0CVE-2023-31208 – Livestatus command injection in RestAPI
https://notcve.org/view.php?id=CVE-2023-31208
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. • https://checkmk.com/werk/15191 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-140: Improper Neutralization of Delimiters •
CVSS: 5.5EPSS: 0%CPEs: 86EXPL: 0CVE-2023-31207 – Automation user secret logged to Apache access log
https://notcve.org/view.php?id=CVE-2023-31207
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log. • https://checkmk.com/werk/15189 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.8EPSS: 0%CPEs: 89EXPL: 0CVE-2022-46302 – Remote Code Execution with Root Privileges via Broad Apache Permissions
https://notcve.org/view.php?id=CVE-2022-46302
Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host. • https://checkmk.com/werk/14281 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 5.3EPSS: 0%CPEs: 135EXPL: 0CVE-2023-1768 – Symmetric agent data encryption fails silently
https://notcve.org/view.php?id=CVE-2023-1768
Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations. • https://checkmk.com/werk/15423 • CWE-446: UI Discrepancy for Security Feature •
CVSS: 5.4EPSS: 0%CPEs: 77EXPL: 0CVE-2023-22288 – Email HTML Injection
https://notcve.org/view.php?id=CVE-2023-22288
HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails • https://checkmk.com/werk/15069 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-138: Improper Neutralization of Special Elements •