PT-2023-32591 · Tribe29 · Tribe29 Checkmk Appliance

Published 2023-11-27 · Updated 2024-08-26 · CVE-2023-6287

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tribe29 Checkmk Appliance versions prior to 1.6.8

Description The issue allows a local attacker to expose sensitive data by retrieving passwords via reading log files. This is possible due to a sensitive data exposure in Webconf.

Recommendations For versions prior to 1.6.8, update to version 1.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

CWE-598

Related Identifiers

CVE-2023-6287

Affected Products

Tribe29 Checkmk Appliance

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6287 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6287 · Vendor Advisory
• https://checkmk.com/werk/9554 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-6287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6287 · Security Note
• https://t.me/cvenotify/61250 · Telegram Post
• https://t.me/cvenotify/61837 · Telegram Post