Skip to content
OpenAdvisories
High WID-SEC-2022-1259 2 CVEs

tribe29 checkmk: Mehrere Schwachstellen ermöglichen Codeausführung

Published Sep 1, 2022 · Updated Feb 20, 2023 · Revision 2 · de-DE

Vendor: Tribe29 Product: Checkmk Product: checkmk < 1.6.0p30 Product: checkmk < 2.0.0p28 Product: checkmk < 2.1.0p11 Product: checkmk < 2.2.0i1 Platform: Linux

Summary

Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in tribe29 checkmk ausnutzen, um beliebigen Programmcode auszuführen.

Product

Checkmk ist eine IT-Monitoring-Software.

Vulnerabilities 2

  • Critical 9.1
    CVE-2022-46836

    PHP code injection in watolib

    PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component.

    Tribe29 Checkmk check-mk Ubuntu
  • High 8.0
    CVE-2022-46303

    Command injection in SMS notifications

    Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within …

    Tribe29 Checkmk check-mk Ubuntu

Revision history

  1. #2

    CVE Nummern ergänzt

  2. #1

    Initiale Fassung

References