PT-2023-15695 · Checkmk · Checkmk

Published 2023-02-20 · Updated 2024-07-23 · CVE-2022-48318

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.0.0 through 2.0.0p29 Checkmk versions 2.1.0 through 2.1.0p13

Description The issue is related to the lack of authorization controls in the RestAPI documentation for Checkmk, which may lead to unintended information disclosure. This happens through automatically generated user-specific tags within the Rest API documentation.

Recommendations For Checkmk versions 2.0.0 through 2.0.0p29, consider restricting access to the RestAPI documentation to minimize the risk of exploitation. For Checkmk versions 2.1.0 through 2.1.0p13, consider restricting access to the RestAPI documentation to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-48318

Affected Products

Checkmk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-48318 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48318 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48318 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48318 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48318 · Vendor Advisory
• https://checkmk.com/werk/14509 · Vendor Advisory
• https://t.me/cibsecurity/58541 · Telegram Post