Livestatus injection in ajax_search
CVE-2023-6157
8.8HIGH
What is CVE-2023-6157?
The Checkmk software versions 2.0.0p39 and prior, along with versions prior to 2.1.0p37 and 2.2.0p15, are susceptible to an improper neutralization of livestatus command delimiters in the ajax_search functionality. This vulnerability enables authorized users to execute arbitrary livestatus commands, potentially leading to unauthorized access and manipulation of the system. Organizations utilizing these versions should prioritize upgrading to mitigate the risks associated with this input handling flaw.
Affected Version(s)
Checkmk 2.2.0 < 2.2.0p15
Checkmk 2.1.0 < 2.1.0p37
Checkmk 2.0.0 <= 2.0.0p39