PT-2024-15070 · Checkmk · Checkmk

Published 2024-01-12 · Updated 2024-07-23 · CVE-2023-6740

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.2.0p18 Checkmk versions prior to 2.1.0p38 Checkmk versions prior to 2.0.0p39

Description The issue allows a local user to escalate privileges due to a problem in the jar signature agent plugin.

Recommendations For versions prior to 2.2.0p18, update to version 2.2.0p18 or later. For versions prior to 2.1.0p38, update to version 2.1.0p38 or later. For versions prior to 2.0.0p39, update to version 2.0.0p39 or later.

Fix

Improper Privilege Management

Uncontrolled Search Path Element

Weakness Enumeration

CWE-269

CWE-427

Related Identifiers

CVE-2023-6740

Affected Products

Checkmk

References · 8

• https://cve.org/CVERecord?id=CVE-2023-6740 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6740 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6740 · Vendor Advisory
• https://checkmk.com/werk/16163 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6740 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1745770209175117994 · Twitter Post
• https://t.me/cvenotify/67968 · Telegram Post