Privilege Escalation in Checkmk mk_mysql Agent Plugin for Windows

CVE-2024-47091

What is CVE-2024-47091?

A vulnerability exists in the mk_mysql agent plugin for Windows that allows a local unprivileged user to exploit it for privilege escalation. By creating a Windows service with a name that matches 'MySQL' or 'MariaDB', or having write access to a binary linked to such a service, an attacker can execute arbitrary code within the context of the Checkmk agent service, which typically operates with SYSTEM-level privileges. This vulnerability affects specific versions of Checkmk, underscoring the importance of updating to secure software releases.

References