PT-2024-28244 · Checkmk · Checkmk

Published 2024-10-14 · Updated 2024-12-03 · CVE-2024-38863

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.3.0p18 Checkmk versions prior to 2.2.0p35 Checkmk versions prior to 2.1.0p48

Description Exposure of CSRF tokens in query parameters on specific requests could lead to a leak of the token, facilitating targeted phishing attacks.

Recommendations For versions prior to 2.3.0p18, update to version 2.3.0p18 or later. For versions prior to 2.2.0p35, update to version 2.2.0p35 or later. For versions prior to 2.1.0p48, update to version 2.1.0p48 or later.

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2024-38863

Affected Products

Checkmk

References · 11

• https://ubuntu.com/security/CVE-2024-38863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38863 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-38863 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38863 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38863 · Vendor Advisory
• https://checkmk.com/werk/17096 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1845784109508919660 · Twitter Post
• https://twitter.com/transilienceai/status/1845874639173808415 · Twitter Post
• https://twitter.com/transilienceai/status/1845874630801940834 · Twitter Post
• https://t.me/cvedetector/7801 · Telegram Post
• https://twitter.com/CVEnew/status/1845731420595216701 · Twitter Post