Skip to content
OpenAdvisories

Vendor

Tribe29

21 known vulnerabilities.

Tribe29 at a glance

Last 12 months
0
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Checkmk 17 Checkmk Appliance 4 checkmk < 2.2.0p18 0 checkmk < 2.0.0p38 0 checkmk < 2.1.0p38 0 checkmk < 2.1.0p32 0 checkmk < 2.2.0p8 0 checkmk < 2.2.0p17 0 checkmk <= 2.0.0p32 0 checkmk <= 2.1.0p18 0 checkmk < 2.1.0p7 0 checkmk < 2.2.0p15 0 checkmk < 2.1.0p37 0 checkmk < 2.0.0p28 0 checkmk < 1.6.0p30 0 checkmk < 2.1.0p11 0 checkmk 2.1.0p27 0 checkmk < 2.1.0p14 0 checkmk < 2.0.0p30 0 checkmk < 2.3.0b1 0 checkmk < 2.2.0b1 0 checkmk < 2.2.0p12 0 checkmk < 2.1.0p35 0 Checkmk Checkmk 0 checkmk < 2.0.0p27 0 checkmk < 2.2.0i1 0 checkmk < 2.1.0p4 0 checkmk Appliance < 1.6.5 0 checkmk < 2.2.0b4 0 checkmk < 1.6.8 0 checkmk < 1.6.0p29 0 checkmk < 2.1.0b9 0 checkmk < 2.0.0p25 0 checkmk < 2.2.0b8 0 checkmk < 2.1.0p28 0 checkmk < 2.2.0p4 0 checkmk < 2.0.0p36 0 checkmk < 2.1.0p25 0 checkmk < 2.0.0p35 0 checkmk < 1.2.8p26 0

Latest advisories

  • Medium max 5.9
    WID-SEC-2024-0093 1 CVE rev. 21

    OpenSSL: Schwachstelle ermöglicht Denial of Service

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen.

    IBM Red Hat Dell SUSE Hitachi Linux
    first Jan 15, 2024
  • Medium max 5.5
    WID-SEC-2024-0181 1 CVE rev. 46

    OpenSSL: Schwachstelle ermöglicht Denial of Service

    Ein Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen.

    IBM Red Hat Dell Siemens Splunk Linux Windows macOS
    first Jan 23, 2024
  • Medium max 6.1
    WID-SEC-2023-1603 1 CVE rev. 3

    tribe29 checkmk: Schwachstelle ermöglicht Offenlegung von Informationen

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in tribe29 checkmk ausnutzen, um Informationen offenzulegen.

    Red Hat Dell Tribe29 Linux
    first Jun 29, 2023
  • Medium max 7.5
    WID-SEC-2022-0065 1 CVE rev. 70

    OpenSSL: Schwachstelle ermöglicht Denial of Service

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen.

    Oracle IBM Red Hat Dell Siemens Linux
    first Mar 15, 2022
  • Medium max 7.5
    WID-SEC-2023-2741 1 CVE rev. 19

    OpenSSL: Schwachstelle ermöglicht Offenlegung von Informationen

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Informationen offenzulegen.

    Oracle IBM Red Hat Dell Siemens Linux
    first Oct 24, 2023
All Critical High Medium Low Exploited only Public exploit

21 results · Feed

  • Medium 4.3
    CVE-2023-22359

    User-enumeration in RestAPI

    User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.

    Tribe29 Checkmk check-mk Ubuntu
  • High 7.5
    CVE-2023-22318

    Denial of service against webconf

    Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.

    Tribe29 Checkmk Appliance check-mk Ubuntu
  • Medium 4.4
    CVE-2023-31207

    Automation user secret logged to Apache access log

    Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.

    Tribe29 Checkmk check-mk Ubuntu
  • High 8.8
    CVE-2022-46302

    Remote Code Execution with Root Privileges via Broad Apache Permissions

    Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an at…

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 6.1
    CVE-2023-22309

    Reflected Cross Site Scripting (XSS)

    Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4.

    Tribe29 Checkmk Appliance check-mk Ubuntu
  • High 8.8
    CVE-2023-22294

    Privilege escalation in Checkmk Appliance

    Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions.

    Tribe29 Checkmk Appliance check-mk Ubuntu
  • Medium 5.5
    CVE-2023-22307

    Site-Passwords in GET parameters

    Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files.

    Tribe29 Checkmk Appliance check-mk Ubuntu
  • Medium 4.3
    CVE-2023-2020

    Unauthorized scheduling of downtimes via REST API

    Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.

    Tribe29 Checkmk check-mk Ubuntu
  • Low 3.7
    CVE-2023-1768

    Symmetric agent data encryption fails silently

    Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations.

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 6.8
    CVE-2023-22288

    Email HTML Injection

    HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 5.4
    CVE-2022-48320

    CSRF in add-visual endpoint

    Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 6.5
    CVE-2022-48319

    Host secret disclosed in Checkmk logs

    Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file.

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 5.3
    CVE-2022-48318

    Insecure access control mechanisms for RestAPI documentation

    No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation.

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 5.6
    CVE-2022-48317

    Insecure Termination of RestAPI Session Tokens

    Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI.

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 6.8
    CVE-2022-48321

    SSRF in agent-receiver API

    Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API.

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 6.8
    CVE-2022-47909

    LQL Injection in Livestatus HTTP headers

    Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.

    Tribe29 Checkmk check-mk Ubuntu
  • Critical 9.1
    CVE-2022-46836

    PHP code injection in watolib

    PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component.

    Tribe29 Checkmk check-mk Ubuntu
  • High 8.0
    CVE-2022-46303

    Command injection in SMS notifications

    Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within …

    Tribe29 Checkmk check-mk Ubuntu
  • High 8.8
    CVE-2022-43440

    Privilege escalation via manipulated unixcat executable

    Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable

    Tribe29 Checkmk check-mk Ubuntu
  • Medium 6.8
    CVE-2023-0284

    Improper validation of LDAP user IDs

    Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.

    Tribe29 Checkmk check-mk Ubuntu
  • Low 3.5
    CVE-2022-4884

    Path-Traversal in MKP storing

    Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file.

    Tribe29 Checkmk check-mk Ubuntu