PT-2023-32548 · Checkmk · Checkmk

Published 2023-11-22 · Updated 2024-07-23 · CVE-2023-6156

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.0.0p39 Checkmk versions prior to 2.1.0p37 Checkmk versions prior to 2.2.0p15

Description The issue is related to the improper neutralization of livestatus command delimiters in the availability timeline, allowing arbitrary livestatus command execution for authorized users.

Recommendations For versions prior to 2.0.0p39, update to version 2.0.0p39 or later. For versions prior to 2.1.0p37, update to version 2.1.0p37 or later. For versions prior to 2.2.0p15, update to version 2.2.0p15 or later.

Fix

Weakness Enumeration

CWE-140

Related Identifiers

CVE-2023-6156

Affected Products

Checkmk

References · 6

• https://checkmk.com/werk/16221 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6156 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-6156 · Security Note
• https://ubuntu.com/security/CVE-2023-6156 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6156 · Security Note