PT-2024-32406 · Checkmk · Checkmk

Published 2024-11-29 · Updated 2024-12-09 · CVE-2024-47094

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.3.0p22 Checkmk versions prior to 2.2.0p37 Checkmk versions prior to 2.1.0p50 (EOL)

Description The issue concerns the insertion of sensitive information into log files in Checkmk, causing remote site secrets to be written to web log files accessible to local site users. This allows unauthorized access to confidential data.

Recommendations For versions prior to 2.3.0p22, update to version 2.3.0p22 or later to resolve the issue. For versions prior to 2.2.0p37, update to version 2.2.0p37 or later to resolve the issue. For versions prior to 2.1.0p50, since 2.1.0p50 is end of life, consider upgrading to a supported version of Checkmk, such as 2.2.0p37 or later, or 2.3.0p22 or later, to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-47094

Affected Products

Checkmk

References · 10

• https://cve.org/CVERecord?id=CVE-2024-47094 · Security Note
• https://ubuntu.com/security/CVE-2024-47094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47094 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47094 · Vendor Advisory
• https://checkmk.com/werk/17342 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47094 · Vendor Advisory
• https://twitter.com/oktsec/status/1862476064947097630 · Twitter Post
• https://twitter.com/dailycve/status/1864050942531838277 · Twitter Post
• https://twitter.com/CVEnew/status/1862440338482176496 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1862644683530232118 · Twitter Post