PT-2024-15710 · Checkmk · Checkmk

Published 2024-03-22 · Updated 2024-12-04 · CVE-2024-0638

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.3.0b4 (beta) Checkmk versions prior to 2.2.0p24 Checkmk versions prior to 2.1.0p41 Checkmk version 2.0.0

Description The issue is related to a least privilege violation in the Checkmk agent plugins mk oracle, mk oracle.ps1, and mk oracle crs. This allows local users to escalate privileges.

Recommendations For Checkmk versions prior to 2.3.0b4 (beta), update to version 2.3.0b4 (beta) or later. For Checkmk versions prior to 2.2.0p24, update to version 2.2.0p24 or later. For Checkmk versions prior to 2.1.0p41, update to version 2.1.0p41 or later. For Checkmk version 2.0.0, consider upgrading to a newer version as 2.0.0 is end-of-life.

Fix

Weakness Enumeration

CWE-272

Related Identifiers

CVE-2024-0638

Affected Products

Checkmk

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-0638 · Vendor Advisory
• https://checkmk.com/werk/16232 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-0638 · Security Note
• https://ubuntu.com/security/CVE-2024-0638 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0638 · Security Note
• https://twitter.com/CVEnew/status/1771122720279060520 · Twitter Post
• https://t.me/cvenotify/74425 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1771151740915626039 · Twitter Post
• https://t.me/cvenotify/103028 · Telegram Post