PT-2023-15698 · Checkmk · Checkmk

Jan Hörsch · Published 2023-02-20 · Updated 2024-07-23 · CVE-2022-48320

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Checkmk versions 1.6.0 and earlier Checkmk versions 2.0.0 through 2.0.0p31 Checkmk versions 2.1.0 through 2.1.0p17

Description The issue allows an attacker to perform Cross-site Request Forgery (CSRF) attacks, enabling them to add new visual elements to multiple pages. This can be achieved by exploiting the CSRF weakness in the affected Checkmk versions.

Recommendations For Checkmk versions 1.6.0 and earlier, update to a version that is still supported and has the fix for this issue. For Checkmk versions 2.0.0 through 2.0.0p31, update to version 2.0.0p32 or later. For Checkmk versions 2.1.0 through 2.1.0p17, update to version 2.1.0p18 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-48320

Affected Products

Checkmk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-48320 · Security Note
• https://checkmk.com/werk/14924 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48320 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48320 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48320 · Security Note
• https://ubuntu.com/security/CVE-2022-48320 · Vendor Advisory
• https://t.me/cibsecurity/58538 · Telegram Post