PT-2023-14900 · Checkmk · Checkmk

CVE-2022-46303 · Publicado 2023-02-20 · Atualizado 2024-07-23

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions 1.6.0 through 1.6.0p29 Checkmk versions 2.0.0 through 2.0.0p27 Checkmk versions 2.1.0 through 2.1.0p10

Description The issue allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions due to command injection in SMS notifications.

Recommendations For Checkmk versions 1.6.0 through 1.6.0p29, update to a version later than 1.6.0p29 to resolve the issue. For Checkmk versions 2.0.0 through 2.0.0p27, update to a version later than 2.0.0p27 to resolve the issue. For Checkmk versions 2.1.0 through 2.1.0p10, update to a version later than 2.1.0p10 to resolve the issue. As a temporary workaround, consider restricting access to SMS notifications and User Management permissions to minimize the risk of exploitation.

Correção

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

CVE-2022-46303

Produtos afetados

Checkmk

Referências · 7

• https://checkmk.com/werk/14381 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2022-46303 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46303 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-46303 · Aviso do Fabricante
• https://t.me/cibsecurity/58531 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-46303 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-46303 · Aviso do Fabricante