PT-2023-15897 · Checkmk · Checkmk

Niko Wenselowski · Published 2023-01-09 · Updated 2024-07-23 · CVE-2022-4884

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.0.0 through 2.0.0p32 Checkmk versions 2.1.0 through 2.1.0p18

Description The issue allows an administrator to write mkp files to arbitrary locations via a malicious mkp file, due to a path-traversal vulnerability in MKP storing.

Recommendations For Checkmk versions 2.0.0 through 2.0.0p32, update to a version later than 2.0.0p32 to resolve the issue. For Checkmk versions 2.1.0 through 2.1.0p18, update to a version later than 2.1.0p18 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-4884

Affected Products

Checkmk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-4884 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-4884 · Security Note
• https://ubuntu.com/security/CVE-2022-4884 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4884 · Vendor Advisory
• https://checkmk.com/werk/15065 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4884 · Vendor Advisory
• https://t.me/cibsecurity/56165 · Telegram Post