PT-2026-7118 · Checkmk · Checkmk

CVE-2026-24095

·

Publicado

2026-02-09

·

Atualizado

2026-02-09

CVSS v4.0

5.3

Média

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Checkmk versions 2.2.0, 2.3.0 through 2.3.0p42, and 2.4.0 through 2.4.0p20
Description A flaw exists in Checkmk that relates to improper permission enforcement. Users possessing the "Use WATO" permission can access the "Analyze configuration" page directly via its URL, circumventing the necessary "Access analyze configuration" permission check. If these users also have the "Make changes, perform actions" permission, they are able to perform unauthorized actions, including disabling checks or acknowledging results.
Recommendations Update Checkmk to version 2.2.0p43 or later. Update Checkmk to version 2.3.0p43 or later. Update Checkmk to version 2.4.0p21 or later.

Correção

LPE

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

CVE-2026-24095

Produtos afetados

Checkmk