cbcvebase.

Checkmk Gmbh Checkmk vulnerabilities

80 known vulnerabilities affecting checkmk_gmbh/checkmk.

Total CVEs
80
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH31MEDIUM43LOW5

Vulnerabilities

Page 2 of 4
CVE-2024-0670P3HIGHCVSS 7.8≥ 2.2.0, < 2.2.0p23≥ 2.1.0, < 2.1.0p40+1 more2024-03-11
CVE-2024-0670 [HIGH] CWE-427 CVE-2024-0670: Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) al Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges
nvd
CVE-2023-6735P3HIGHCVSS 7.8≥ 2.2.0, < 2.2.0p18≥ 2.1.0, < 2.1.0p38+1 more2024-01-12
CVE-2023-6735 [HIGH] CWE-95 CVE-2023-6735: Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
nvd
CVE-2025-1075P3HIGHCVSS 7.5≥ 2.3.0, < 2.3.0p27≥ 2.2.0, < 2.2.0p40+1 more2025-02-19
CVE-2025-1075 [HIGH] CWE-532 CVE-2025-1075: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2. Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.
nvd
CVE-2025-39666P3HIGHCVSS 7.3v2.2.0≥ 2.3.0, < 2.3.0p46+2 more2026-04-07
CVE-2025-39666 [HIGH] CWE-426 CVE-2025-39666: Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 befo Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root.
nvd
CVE-2025-64998P3HIGHCVSS 7.2≥ 2.4.0, < 2.4.0p23≥ 2.3.0, < 2.3.0p45+1 more2026-03-24
CVE-2025-64998 [HIGH] CWE-522 CVE-2025-64998: Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies.
nvd
CVE-2023-6740P3HIGHCVSS 7.8≥ 2.2.0, < 2.2.0p18≥ 2.1.0, < 2.1.0p38+1 more2024-01-12
CVE-2023-6740 [HIGH] CWE-427 CVE-2023-6740: Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
nvd
CVE-2024-38863P3HIGHCVSS 7.5≥ 2.1.0, < 2.1.0p48≥ 2.2.0, < 2.2.0p35+1 more2024-10-14
CVE-2024-38863 [HIGH] CWE-598 CVE-2024-38863: Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.
nvd
CVE-2024-6747P3HIGHCVSS 7.5≥ 2.3.0, < 2.3.0p18≥ 2.2.0, < 2.2.0p36+2 more2024-10-10
CVE-2024-6747 [HIGH] CWE-201 CVE-2024-6747: Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data
nvd
CVE-2024-6572P3HIGHCVSS 7.4≥ 2.3.0, < 2.3.0p15≥ 2.2.0, < 2.2.0p33+2 more2024-09-09
CVE-2024-6572 [HIGH] CWE-322 CVE-2024-6572: Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and fi Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48 and 2.0.0 (EOL) allows man-in-the-middle attackers to intercept traffic
nvd
CVE-2024-6542P3MEDIUMCVSS 6.5≥ 2.3.0, < 2.3.0p11≥ 2.2.0, < 2.2.0p32+2 more2024-07-22
CVE-2024-6542 [MEDIUM] CWE-140 CVE-2024-6542: Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1. Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows arbitrary livestatus command execution.
nvd
CVE-2024-28824P3HIGHCVSS 7.8≥ 2.3.0, < 2.3.0b4≥ 2.2.0, < 2.2.0p24+2 more2024-03-22
CVE-2024-28824 [HIGH] CWE-272 CVE-2024-28824: Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin b Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
nvd
CVE-2024-28829P3HIGHCVSS 7.8≥ 2.3.0, < 2.3.0p12≥ 2.2.0, < 2.2.0p32+2 more2024-08-20
CVE-2024-28829 [HIGH] CWE-272 CVE-2024-28829: Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin b Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL) allows local users to escalate privileges.
nvd
CVE-2024-28828P3HIGHCVSS 8.8≥ 2.3.0, < 2.3.0p8≥ 2.2.0, < 2.2.0p29+2 more2024-07-10
CVE-2024-28828 [HIGH] CWE-352 CVE-2024-28828: Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site.
nvd
CVE-2026-33457P3MEDIUMCVSS 6.3≥ 2.5.0, < 2.5.0b4≥ 2.4.0, < 2.4.0p26+1 more2026-04-10
CVE-2026-33457 [MEDIUM] CWE-140 CVE-2026-33457: Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allo Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value.
nvd
CVE-2025-39664P3MEDIUMCVSS 6.5≥ 2.4.0, < 2.4.0p13≥ 2.3.0, < 2.3.0p38+2 more2025-10-09
CVE-2025-39664 [MEDIUM] CWE-22 CVE-2025-39664: Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1 Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the storage location of report file pairs beyond their intended root directory.
nvd
CVE-2026-33455P3MEDIUMCVSS 6.3≥ 2.5.0, < 2.5.0b42026-04-10
CVE-2026-33455 [MEDIUM] CWE-140 CVE-2026-33455: Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attac Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due to insufficient input sanitization in search filter plugins.
nvd
CVE-2025-39663P3HIGHCVSS 8.4≥ 2.4.0, < 2.4.0p14≥ 2.3.0, < 2.3.0p39+2 more2025-10-30
CVE-2025-39663 [HIGH] CWE-80 CVE-2025-39663: Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised re Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).
nvd
CVE-2025-64997P3MEDIUMCVSS 6.5≥ 2.4.0, < 2.4.0p17≥ 2.3.0, < 2.3.0p422025-12-18
CVE-2025-64997 [MEDIUM] CWE-280 CVE-2025-64997: Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-priv Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.
nvd
CVE-2024-6163P4MEDIUMCVSS 5.3≥ 2.3.0, < 2.3.0p10≥ 2.2.0, < 2.2.0p31+2 more2024-07-08
CVE-2024-6163 [MEDIUM] CWE-290 CVE-2024-6163: Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows r Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data
nvd
CVE-2026-24095P4MEDIUMCVSS 5.3≥ 2.4.0, < 2.4.0p21≥ 2.3.0, < 2.3.0p43+1 more2026-02-09
CVE-2026-24095 [MEDIUM] CWE-862 CVE-2026-24095: Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, an Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows users with the "Use WATO" permission to access the "Analyze configuration" page by directly navigating to its URL, bypassing the intended "Access analyze configuration" permission check. If these users also have the "Make changes,
nvd
← Previous2 / 4Next →
Checkmk Gmbh Checkmk vulnerabilities | cvebase