PT-2023-18415 · Tribe29 · Tribe29 Checkmk Appliance

Published 2023-04-18 · Updated 2023-04-27 · CVE-2023-22307

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tribe29 Checkmk Appliance versions prior to 1.6.4

Description The issue allows a local attacker to retrieve passwords by reading log files, specifically due to sensitive data exposure in Webconf. This can lead to unauthorized access to sensitive information.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Information Disclosure

Weakness Enumeration

CWE-598

CWE-668

CWE-200

Related Identifiers

CVE-2023-22307

Affected Products

Tribe29 Checkmk Appliance

References · 8

• https://checkmk.com/werk/9522 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22307 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22307 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22307 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22307 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22307 · Security Note
• https://t.me/cvenotify/49212 · Telegram Post
• https://t.me/cibsecurity/62375 · Telegram Post