Skip to content
OpenAdvisories
Low WID-SEC-2024-3160 2 CVEs

Checkmk: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Oct 13, 2024 · Updated Oct 13, 2024 · de-DE

Vendor: Checkmk Product: Checkmk

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Checkmk ausnutzen, um Informationen offenzulegen.

Product

Checkmk ist eine IT-Monitoring-Software.

Vulnerabilities 2

  • Medium 5.1
    CVE-2024-38862

    SNMP and IMPI secrets written to audit log

    Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators.

    Checkmk Checkmk check-mk Ubuntu
  • Low 2.0
    CVE-2024-38863

    CSRF token leaked in URL parameters

    Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.

    Checkmk Checkmk check-mk Ubuntu

Revision history

  1. #1

    Initiale Fassung

References