PT-2023-32549 · Checkmk · Checkmk

CVE-2023-6157 · Publicado 2023-11-22 · Atualizado 2024-07-23

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.0.0p39 Checkmk versions prior to 2.1.0p37 Checkmk versions prior to 2.2.0p15

Description The issue is related to the improper neutralization of livestatus command delimiters in the ajax search function, allowing arbitrary livestatus command execution for authorized users.

Recommendations For versions prior to 2.0.0p39, update to version 2.0.0p39 or later to resolve the issue. For versions prior to 2.1.0p37, update to version 2.1.0p37 or later to resolve the issue. For versions prior to 2.2.0p15, update to version 2.2.0p15 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-140

Identificadores relacionados

CVE-2023-6157

Produtos afetados

Checkmk

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6157.json · Exploit
• https://checkmk.com/werk/16221 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-6157 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-6157 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-6157 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6157 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-6157 · Aviso do Fabricante