PT-2024-22598 · Checkmk · Checkmk

Published 2024-06-26 · Updated 2024-12-04 · CVE-2024-28830

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.3.0p7 Checkmk versions prior to 2.2.0p28 Checkmk versions prior to 2.1.0p45 Checkmk versions prior to or equal to 2.0.0p39

Description The issue allows sensitive information to be inserted into log files, causing automation user secrets to be written to audit log files. These log files are accessible to administrators.

Recommendations For versions prior to 2.3.0p7, update to version 2.3.0p7 or later. For versions prior to 2.2.0p28, update to version 2.2.0p28 or later. For versions prior to 2.1.0p45, update to version 2.1.0p45 or later. For versions prior to or equal to 2.0.0p39, consider upgrading to a supported version, as 2.0.0p39 is end-of-life.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-28830

Affected Products

Checkmk

References · 6

• https://checkmk.com/werk/17056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28830 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28830 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28830 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28830 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28830 · Vendor Advisory