PT-2023-15068

CVE-2022-46836

Published

2023-02-20

Updated

2024-07-23

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Checkmk versions 1.6.0 through 1.6.0p29 Checkmk versions 2.0.0 through 2.0.0p27 Checkmk versions 2.1.0 through 2.1.0p10

Description The issue allows an attacker to inject and execute PHP code in the auth.php and hosttags.php files of the watolib component, which will be executed upon request of the vulnerable component.

Recommendations For Checkmk versions 1.6.0 through 1.6.0p29, update to a version later than 1.6.0p29. For Checkmk versions 2.0.0 through 2.0.0p27, update to a version later than 2.0.0p27. For Checkmk versions 2.1.0 through 2.1.0p10, update to a version later than 2.1.0p10.

Exploitability

Exploit

Fix

Impacts

Researchers

Stefan Schiller

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers