PT-2024-28245 · Checkmk · Checkmk

Published 2024-12-19 · Updated 2024-12-19 · CVE-2024-38864

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.3.0p23 Checkmk versions prior to 2.2.0p38 Checkmk versions prior to or equal to 2.1.0p49

Description The issue is related to incorrect permissions on the Checkmk Windows Agent's data directory, allowing a local attacker to read sensitive data.

Recommendations For versions prior to 2.3.0p23, update to version 2.3.0p23 or later. For versions prior to 2.2.0p38, update to version 2.2.0p38 or later. For versions prior to or equal to 2.1.0p49, update to a version later than 2.1.0p49, or consider alternative measures as 2.1.0p49 is end-of-life.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-38864

Affected Products

Checkmk

References · 6

• https://osv.dev/vulnerability/CVE-2024-38864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38864 · Security Note
• https://checkmk.com/werk/17098 · Vendor Advisory
• https://t.me/cvedetector/13341 · Telegram Post
• https://twitter.com/CVEnew/status/1869783930011853091 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869790963733758244 · Twitter Post