Livestatus injection in ajax_search
CVE-2023-6157

8.8HIGH

Key Information:

Vendor

Checkmk GmbH

Status
Checkmk
Vendor
CVE Published:
22 November 2023

What is CVE-2023-6157?

The Checkmk software versions 2.0.0p39 and prior, along with versions prior to 2.1.0p37 and 2.2.0p15, are susceptible to an improper neutralization of livestatus command delimiters in the ajax_search functionality. This vulnerability enables authorized users to execute arbitrary livestatus commands, potentially leading to unauthorized access and manipulation of the system. Organizations utilizing these versions should prioritize upgrading to mitigate the risks associated with this input handling flaw.

Affected Version(s)

Checkmk 2.2.0 < 2.2.0p15

Checkmk 2.1.0 < 2.1.0p37

Checkmk 2.0.0 <= 2.0.0p39

References

https://checkmk.com/werk/16221

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.