PT-2023-32549 · Checkmk · Checkmk

Published 2023-11-22 · Updated 2024-07-23 · CVE-2023-6157

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.0.0p39 Checkmk versions prior to 2.1.0p37 Checkmk versions prior to 2.2.0p15

Description The issue is related to the improper neutralization of livestatus command delimiters in the ajax search function, allowing arbitrary livestatus command execution for authorized users.

Recommendations For versions prior to 2.0.0p39, update to version 2.0.0p39 or later to resolve the issue. For versions prior to 2.1.0p37, update to version 2.1.0p37 or later to resolve the issue. For versions prior to 2.2.0p15, update to version 2.2.0p15 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-140

Related Identifiers

CVE-2023-6157

Affected Products

Checkmk

References · 6

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6157 · Vendor Advisory
• https://checkmk.com/werk/16221 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6157 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-6157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6157 · Security Note