CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2023-22359 – User-enumeration in RestAPI
https://notcve.org/view.php?id=CVE-2023-22359
User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. • https://checkmk.com/werk/15890 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 4.3EPSS: 0%CPEs: 45EXPL: 0CVE-2023-22348 – Reading host_configs does not honour contact groups
https://notcve.org/view.php?id=CVE-2023-22348
Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. • https://checkmk.com/werk/13982 • CWE-285: Improper Authorization •
CVSS: 8.8EPSS: 0%CPEs: 90EXPL: 0CVE-2023-31208 – Livestatus command injection in RestAPI
https://notcve.org/view.php?id=CVE-2023-31208
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. • https://checkmk.com/werk/15191 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-140: Improper Neutralization of Delimiters •
CVSS: 5.5EPSS: 0%CPEs: 86EXPL: 0CVE-2023-31207 – Automation user secret logged to Apache access log
https://notcve.org/view.php?id=CVE-2023-31207
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log. • https://checkmk.com/werk/15189 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 41EXPL: 0CVE-2023-2020 – Unauthorized scheduling of downtimes via REST API
https://notcve.org/view.php?id=CVE-2023-2020
Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. • https://checkmk.com/werk/13981 • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-863: Incorrect Authorization •