PT-2025-48802 · Unknown+3 · Checkmk Multisiteauth+3

Shortfinga · Published 2025-12-03 · Updated 2025-12-19 · CVE-2025-39665

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagvis Checkmk MultisiteAuth versions prior to 1.9.48

Description An unauthenticated attacker can enumerate Checkmk usernames. This issue affects the user enumeration functionality within the software.

Recommendations Update to version 1.9.48 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2025-39665

Affected Products

Checkmk

Checkmk Multisiteauth

Debian

Nagvis

References · 14

• https://github.com/NagVis/nagvis/pull/411/commits/4acabcf9d5b2d26f390e760f59def8e163908d66 · Patch
• https://osv.dev/vulnerability/CVE-2025-39665 · Vendor Advisory
• https://nagvis.org/downloads/changelog/1.9.48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39665 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39665 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-39665 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39665 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-39665 · Security Note
• https://ubuntu.com/security/CVE-2025-39665 · Vendor Advisory
• https://github.com/NagVis/nagvis/pull/411 · Note
• https://t.me/CVEtracker/38743 · Telegram Post
• https://t.me/cveNotify/146393 · Telegram Post
• https://twitter.com/CVEnew/status/1996162433157681286 · Twitter Post
• https://t.me/cveNotify/144594 · Telegram Post