PT-2025-47325 · Checkmk · Checkmk

Published 2025-11-18 · Updated 2025-11-24 · CVE-2025-58122

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.4.0p16

Description A flaw exists in Checkmk where inadequate permission checks allow users with limited privileges to alter notification settings through the REST API. This could potentially result in unauthorized actions or the exposure of sensitive information. The vulnerable API endpoint is used for managing notification parameters. The affected parameter is not specified.

Recommendations Update to version 2.4.0p16 or later.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2025-58122

Affected Products

Checkmk

References · 8

• https://checkmk.com/werk/18982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58122 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-58122 · Security Note
• https://ubuntu.com/security/CVE-2025-58122 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58122 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58122 · Vendor Advisory
• https://twitter.com/CVEnew/status/1991042990966452394 · Twitter Post
• https://t.me/cveNotify/143785 · Telegram Post