CVE-2025-2596
published 2025-03-26CVE-2025-2596: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.19%
9.4th percentile
Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| checkmk | checkmk | < 2.1.0 | 2.1.0 |
| checkmk | checkmk | — | — |
| checkmk | checkmk | — | — |
| checkmk | checkmk | — | — |
| checkmk_gmbh | checkmk | 2.1.0 – 2.1.0p50 | — |
| checkmk_gmbh | checkmk | >= 2.2.0 < 2.2.0p41 | 2.2.0p41 |
| checkmk_gmbh | checkmk | >= 2.3.0 < 2.3.0p30 | 2.3.0p30 |
| checkmk_gmbh | checkmk | >= 2.4.0 < 2.4.0b2 | 2.4.0b2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa6.8MEDIUM
osv2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jujutsu does not have SHA-1 collision detection
ghsa·2025-04-07·CVSS 6.8
CVE-2025-31130 [MEDIUM] CWE-328 Jujutsu does not have SHA-1 collision detection
Jujutsu does not have SHA-1 collision detection
### Summary
Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks.
### Details
This is a result of the underlying [CVE-2025-31130 / GHSA-2frx-2596-x5r6](https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6) vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu.
### Impact
An attacker with the ability to mount a collision attack on SHA-1 like the [SHAttered](https://shattered.io/) or [SHA-1 is a Shambles](https://sha-mbles.github.io/) a
GHSA
GHSA-f4hc-mpg9-vm8w: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2
ghsa_unreviewed·2025-03-26
CVE-2025-2596 [LOW] CWE-613 GHSA-f4hc-mpg9-vm8w: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2
Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)
OSV
CVE-2025-2596: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2
osv·2025-03-26·CVSS 2.3
CVE-2025-2596 [LOW] CVE-2025-2596: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2
Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-26
Published