PT-2024-37423 · Checkmk · Checkmk

Published 2024-07-08 · Updated 2024-08-20 · CVE-2024-6163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p10 Checkmk versions prior to 2.2.0p31 Checkmk versions prior to 2.1.0p46 Checkmk versions prior to or equal to 2.0.0p39

Description: The issue allows a remote attacker to bypass authentication and access data through certain HTTP endpoints of Checkmk.

Recommendations: For versions prior to 2.3.0p10, update to version 2.3.0p10 or later. For versions prior to 2.2.0p31, update to version 2.2.0p31 or later. For versions prior to 2.1.0p46, update to version 2.1.0p46 or later. For versions prior to or equal to 2.0.0p39, update to a version later than 2.0.0p39.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-6163

Affected Products

Checkmk

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6163 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-6163 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6163 · Vendor Advisory
• https://checkmk.com/werk/17011 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6163 · Vendor Advisory
• https://twitter.com/CVEnew/status/1810307181314723957 · Twitter Post
• https://t.me/cvedetector/179 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1810318380945043847 · Twitter Post