PT-2025-20885 · Checkmk · Checkmk

Published 2025-05-13 · Updated 2025-05-13 · CVE-2025-32917

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.4.0b7 (beta) Checkmk versions prior to 2.3.0p32 Checkmk versions prior to 2.2.0p42 Checkmk version 2.1.0p49

Description: The issue allows a user with write access to the JAVA HOME/bin directory to escalate privileges. This is related to the jar signature agent plugin.

Recommendations: For versions prior to 2.4.0b7 (beta), update to version 2.4.0b7 or later. For versions prior to 2.3.0p32, update to version 2.3.0p32 or later. For versions prior to 2.2.0p42, update to version 2.2.0p42 or later. For version 2.1.0p49, consider upgrading to a supported version, as 2.1.0p49 is end-of-life.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-32917

Affected Products

Checkmk

References · 8

• https://checkmk.com/werk/17985 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-32917 · Security Note
• https://ubuntu.com/security/CVE-2025-32917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32917 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-32917 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32917 · Vendor Advisory
• https://t.me/cvetracker/23734 · Telegram Post
• https://twitter.com/CVEnew/status/1922244092005617871 · Twitter Post