Checkmk Gmbh
Monthly
Stored/reflected cross-site scripting in Checkmk monitoring platform versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases allows authenticated users to bypass URL validation by leveraging HTML-encoded characters, enabling injection of javascript: URIs that execute in another user's browser session. The CVSS 4.0 score of 8.5 reflects the high impact on confidentiality, integrity, and availability when a victim interacts with a crafted link, though no public exploit identified at time of analysis and the issue requires both low-privilege authentication and user interaction.
Stored cross-site scripting in Checkmk monitoring platform allows a low-privileged user with dashboard editing rights to embed a javascript: URI inside the URL dashboard widget, which then executes in the browser of any other user viewing that dashboard. The flaw affects Checkmk versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases, and carries a CVSS 4.0 score of 8.5 due to the high confidentiality and integrity impact achievable against higher-privileged operators. No public exploit identified at time of analysis, but the prerequisite (dashboard edit permission) is commonly granted to operations staff.
Stored cross-site scripting in Checkmk dashboard dashlet title links enables authenticated attackers with dashboard creation privileges to execute malicious JavaScript in victims' browsers when they click crafted dashlet links on shared dashboards. Affects Checkmk 2.2.0 (EOL), 2.3.0 before p46, 2.4.0 before p25, and 2.5.0 beta before b3. Vendor-released patches are available for all supported versions. EPSS score of 0.05% (14th percentile) indicates low predicted exploitation probability, and no public exploit identified at time of analysis, though CVSS 8.5 reflects the high impact of successful exploitation (complete confidentiality, integrity, and availability compromise in victim context).
Stored cross-site scripting (XSS) in Checkmk 2.5.0 beta allows authenticated users with pending change permissions to inject malicious JavaScript into the Pending Changes sidebar, executing in the browsers of other users who view that sidebar. This vulnerability affects the beta release 2.5.0 before version 2.5.0b2 and requires existing user authentication with specific permissions to exploit.
Stored cross-site scripting (XSS) in Checkmk 2.5.0 beta versions before 2.5.0b2 allows authenticated users with host or service creation permissions to inject malicious JavaScript that executes in the browsers of other users when they perform searches via the Unified Search feature, potentially enabling session hijacking, credential theft, or administrative account compromise.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
Missing authorization in Checkmk's background job subsystem allows any authenticated user to view the status and output of background jobs by knowing the job ID, potentially exposing data from jobs initiated by other users or higher-privileged roles. Affected releases span the entire 2.2.0 branch and versions below 2.5.0p12, 2.4.0p36, and 2.3.0p50. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; real-world impact is bounded to information disclosure within authenticated sessions.
Incorrect authorization in Checkmk's frozen BI (Business Intelligence) aggregation feature exposes host and service names to authenticated users whose visibility should be restricted. Specifically, users with intentionally scoped permissions can infer the existence and names of hosts and services outside their authorized scope by querying frozen BI aggregations. Affects all 2.2.0 versions and versions prior to 2.3.0p47, 2.4.0p29, and 2.5.0p2. No public exploit code exists and no active exploitation is confirmed; CVSS 4.0 score of 2.3 reflects the constrained, low-impact nature of this information disclosure.
Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Checkmk's mk_sap_hana agent plugin allows a local unprivileged user to execute arbitrary commands as root by planting a process whose name mimics a SAP HANA instance. The plugin, when running as root under the RUNAS=agent configuration and lacking explicit database configuration, blindly reads the OS process list to derive SAP HANA instance identifiers and injects them unsanitized into a shell command executed with root privileges - a textbook CWE-78 OS command injection. No public exploit code or CISA KEV listing exists at time of analysis, but the attack prerequisites are achievable on any misconfigured Checkmk deployment that monitors SAP environments.
Stored cross-site scripting in Checkmk's service discovery active check output allows a high-privileged administrator to inject persistent malicious HTML or JavaScript that executes in the browsers of other administrators or users with host read permissions when they run checks on the service discovery page. Affected versions span all currently maintained branches: Checkmk below 2.5.0p5, below 2.4.0p31, below 2.3.0p48, and all 2.2.0 releases with no patch for that branch. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the stored nature of the XSS and its targeting of privileged user sessions make it a meaningful lateral-privilege and session-compromise vector within Checkmk deployments.
Stored cross-site scripting in Checkmk's global settings change log enables a high-privileged administrator to persist malicious HTML or JavaScript within changelog messages, which then executes silently in the browsers of other authenticated users who view the Activate Changes page or Audit log. Affected versions span all 2.2.0 releases and builds prior to 2.5.0p5, 2.4.0p31, and 2.3.0p48. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis; however, the insider-threat angle - an already-privileged admin targeting peer users - is the realistic concern here.
Incorrect authorization in Checkmk's User Messages dashboard widget exposes the dashboard creator's personal messages to any party possessing a valid public dashboard share token. The message-fetching endpoints resolve messages using the dashboard creator's identity rather than the requesting party's identity, meaning that direct API calls with a share token return the issuer's private messages regardless of whether the User Messages widget is actually present on the shared dashboard. All Checkmk deployments running versions prior to 2.5.0p5 that use the public dashboard sharing feature are affected. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Livestatus command injection in Checkmk prediction graph page allows authenticated users to execute arbitrary Livestatus commands by injecting malicious service name parameters due to insufficient input sanitization. Affected versions include Checkmk 2.3.0 before p47, 2.4.0 before p26, and 2.5.0 before b4. The vulnerability requires valid authentication credentials to exploit and results in limited confidentiality, integrity, and availability impact within the Livestatus subsystem.
Livestatus injection in Checkmk's notification test mode allows authenticated users with high privileges to inject arbitrary Livestatus commands via crafted service descriptions in versions prior to 2.5.0b4 and 2.4.0p26. The vulnerability has a CVSS score of 5.1 with limited confidentiality and integrity impact, requiring high-privilege authentication. No public exploit code or active exploitation has been confirmed at time of analysis.
Livestatus injection in Checkmk's monitoring quicksearch function allows authenticated attackers to inject arbitrary livestatus commands through insufficiently sanitized search query parameters in versions prior to 2.5.0b4. The vulnerability requires valid authentication credentials and enables low-impact information disclosure and limited integrity/availability changes within the monitoring system. No public exploit code or active exploitation has been reported at time of analysis.
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site context files processed by the root-executed 'omd' administrative command. Affects Checkmk 2.2.0 (EOL), 2.3.0 before p46, 2.4.0 before p25, and 2.5.0 beta before b3. No public exploit identified at time of analysis. CVSS 9.3 reflects total technical impact, but SSVC assessment indicates non-automatable exploitation requiring existing high-privilege access, tempering the real-world urgency for organizations with strict site user access controls.
Insufficient permission validation in Checkmk REST API Quick Setup endpoints allows low-privileged authenticated users to perform unauthorized administrative actions or access sensitive information in versions 2.5.0 beta before 2.5.0b2 and 2.4.0 before 2.4.0p25. The vulnerability stems from missing authorization checks that fail to enforce role-based access control on multiple API endpoints, enabling privilege escalation within the monitoring platform.
Checkmk exposes its session signing secret in configurations synchronized between remote and central sites, allowing a remote site administrator to forge valid session cookies and hijack user sessions on the central monitoring instance. This vulnerability affects Checkmk versions prior to 2.4.0p23, 2.3.0p45, and all 2.2.0 releases when configuration synchronization is enabled. An attacker with administrative privileges on a remote Checkmk site can leverage this exposure to impersonate any user, including central site administrators, potentially gaining complete control over the monitoring infrastructure.
Checkmk contains an improper permission enforcement vulnerability in the deploy_agent endpoint that allows unauthenticated users to enumerate existing hosts by analyzing differential HTTP response codes, resulting in information disclosure. The vulnerability affects Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and end-of-life version 2.2.0, with a CVSS score of 6.3 indicating moderate severity. An attacker with network access can passively discover the infrastructure topology without authentication, though no known active exploitation or public POC has been confirmed at this time.
Checkmk contains an improper permission enforcement vulnerability in the agent-receiver/register_existing endpoint that allows authenticated users to enumerate existing hosts by observing differential HTTP response codes, enabling information disclosure. This affects Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and the end-of-life 2.2.0 branch. While not currently listed as actively exploited in known vulnerability catalogs, the low CVSS score of 5.3 reflects limited confidentiality impact and the requirement for prior authentication, though the straightforward nature of the enumeration technique presents moderate real-world risk.
Stored/reflected cross-site scripting in Checkmk monitoring platform versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases allows authenticated users to bypass URL validation by leveraging HTML-encoded characters, enabling injection of javascript: URIs that execute in another user's browser session. The CVSS 4.0 score of 8.5 reflects the high impact on confidentiality, integrity, and availability when a victim interacts with a crafted link, though no public exploit identified at time of analysis and the issue requires both low-privilege authentication and user interaction.
Stored cross-site scripting in Checkmk monitoring platform allows a low-privileged user with dashboard editing rights to embed a javascript: URI inside the URL dashboard widget, which then executes in the browser of any other user viewing that dashboard. The flaw affects Checkmk versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases, and carries a CVSS 4.0 score of 8.5 due to the high confidentiality and integrity impact achievable against higher-privileged operators. No public exploit identified at time of analysis, but the prerequisite (dashboard edit permission) is commonly granted to operations staff.
Stored cross-site scripting in Checkmk dashboard dashlet title links enables authenticated attackers with dashboard creation privileges to execute malicious JavaScript in victims' browsers when they click crafted dashlet links on shared dashboards. Affects Checkmk 2.2.0 (EOL), 2.3.0 before p46, 2.4.0 before p25, and 2.5.0 beta before b3. Vendor-released patches are available for all supported versions. EPSS score of 0.05% (14th percentile) indicates low predicted exploitation probability, and no public exploit identified at time of analysis, though CVSS 8.5 reflects the high impact of successful exploitation (complete confidentiality, integrity, and availability compromise in victim context).
Stored cross-site scripting (XSS) in Checkmk 2.5.0 beta allows authenticated users with pending change permissions to inject malicious JavaScript into the Pending Changes sidebar, executing in the browsers of other users who view that sidebar. This vulnerability affects the beta release 2.5.0 before version 2.5.0b2 and requires existing user authentication with specific permissions to exploit.
Stored cross-site scripting (XSS) in Checkmk 2.5.0 beta versions before 2.5.0b2 allows authenticated users with host or service creation permissions to inject malicious JavaScript that executes in the browsers of other users when they perform searches via the Unified Search feature, potentially enabling session hijacking, credential theft, or administrative account compromise.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
Missing authorization in Checkmk's background job subsystem allows any authenticated user to view the status and output of background jobs by knowing the job ID, potentially exposing data from jobs initiated by other users or higher-privileged roles. Affected releases span the entire 2.2.0 branch and versions below 2.5.0p12, 2.4.0p36, and 2.3.0p50. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; real-world impact is bounded to information disclosure within authenticated sessions.
Incorrect authorization in Checkmk's frozen BI (Business Intelligence) aggregation feature exposes host and service names to authenticated users whose visibility should be restricted. Specifically, users with intentionally scoped permissions can infer the existence and names of hosts and services outside their authorized scope by querying frozen BI aggregations. Affects all 2.2.0 versions and versions prior to 2.3.0p47, 2.4.0p29, and 2.5.0p2. No public exploit code exists and no active exploitation is confirmed; CVSS 4.0 score of 2.3 reflects the constrained, low-impact nature of this information disclosure.
Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Checkmk's mk_sap_hana agent plugin allows a local unprivileged user to execute arbitrary commands as root by planting a process whose name mimics a SAP HANA instance. The plugin, when running as root under the RUNAS=agent configuration and lacking explicit database configuration, blindly reads the OS process list to derive SAP HANA instance identifiers and injects them unsanitized into a shell command executed with root privileges - a textbook CWE-78 OS command injection. No public exploit code or CISA KEV listing exists at time of analysis, but the attack prerequisites are achievable on any misconfigured Checkmk deployment that monitors SAP environments.
Stored cross-site scripting in Checkmk's service discovery active check output allows a high-privileged administrator to inject persistent malicious HTML or JavaScript that executes in the browsers of other administrators or users with host read permissions when they run checks on the service discovery page. Affected versions span all currently maintained branches: Checkmk below 2.5.0p5, below 2.4.0p31, below 2.3.0p48, and all 2.2.0 releases with no patch for that branch. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the stored nature of the XSS and its targeting of privileged user sessions make it a meaningful lateral-privilege and session-compromise vector within Checkmk deployments.
Stored cross-site scripting in Checkmk's global settings change log enables a high-privileged administrator to persist malicious HTML or JavaScript within changelog messages, which then executes silently in the browsers of other authenticated users who view the Activate Changes page or Audit log. Affected versions span all 2.2.0 releases and builds prior to 2.5.0p5, 2.4.0p31, and 2.3.0p48. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis; however, the insider-threat angle - an already-privileged admin targeting peer users - is the realistic concern here.
Incorrect authorization in Checkmk's User Messages dashboard widget exposes the dashboard creator's personal messages to any party possessing a valid public dashboard share token. The message-fetching endpoints resolve messages using the dashboard creator's identity rather than the requesting party's identity, meaning that direct API calls with a share token return the issuer's private messages regardless of whether the User Messages widget is actually present on the shared dashboard. All Checkmk deployments running versions prior to 2.5.0p5 that use the public dashboard sharing feature are affected. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity.
Livestatus command injection in Checkmk prediction graph page allows authenticated users to execute arbitrary Livestatus commands by injecting malicious service name parameters due to insufficient input sanitization. Affected versions include Checkmk 2.3.0 before p47, 2.4.0 before p26, and 2.5.0 before b4. The vulnerability requires valid authentication credentials to exploit and results in limited confidentiality, integrity, and availability impact within the Livestatus subsystem.
Livestatus injection in Checkmk's notification test mode allows authenticated users with high privileges to inject arbitrary Livestatus commands via crafted service descriptions in versions prior to 2.5.0b4 and 2.4.0p26. The vulnerability has a CVSS score of 5.1 with limited confidentiality and integrity impact, requiring high-privilege authentication. No public exploit code or active exploitation has been confirmed at time of analysis.
Livestatus injection in Checkmk's monitoring quicksearch function allows authenticated attackers to inject arbitrary livestatus commands through insufficiently sanitized search query parameters in versions prior to 2.5.0b4. The vulnerability requires valid authentication credentials and enables low-impact information disclosure and limited integrity/availability changes within the monitoring system. No public exploit code or active exploitation has been reported at time of analysis.
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site context files processed by the root-executed 'omd' administrative command. Affects Checkmk 2.2.0 (EOL), 2.3.0 before p46, 2.4.0 before p25, and 2.5.0 beta before b3. No public exploit identified at time of analysis. CVSS 9.3 reflects total technical impact, but SSVC assessment indicates non-automatable exploitation requiring existing high-privilege access, tempering the real-world urgency for organizations with strict site user access controls.
Insufficient permission validation in Checkmk REST API Quick Setup endpoints allows low-privileged authenticated users to perform unauthorized administrative actions or access sensitive information in versions 2.5.0 beta before 2.5.0b2 and 2.4.0 before 2.4.0p25. The vulnerability stems from missing authorization checks that fail to enforce role-based access control on multiple API endpoints, enabling privilege escalation within the monitoring platform.
Checkmk exposes its session signing secret in configurations synchronized between remote and central sites, allowing a remote site administrator to forge valid session cookies and hijack user sessions on the central monitoring instance. This vulnerability affects Checkmk versions prior to 2.4.0p23, 2.3.0p45, and all 2.2.0 releases when configuration synchronization is enabled. An attacker with administrative privileges on a remote Checkmk site can leverage this exposure to impersonate any user, including central site administrators, potentially gaining complete control over the monitoring infrastructure.
Checkmk contains an improper permission enforcement vulnerability in the deploy_agent endpoint that allows unauthenticated users to enumerate existing hosts by analyzing differential HTTP response codes, resulting in information disclosure. The vulnerability affects Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and end-of-life version 2.2.0, with a CVSS score of 6.3 indicating moderate severity. An attacker with network access can passively discover the infrastructure topology without authentication, though no known active exploitation or public POC has been confirmed at this time.
Checkmk contains an improper permission enforcement vulnerability in the agent-receiver/register_existing endpoint that allows authenticated users to enumerate existing hosts by observing differential HTTP response codes, enabling information disclosure. This affects Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and the end-of-life 2.2.0 branch. While not currently listed as actively exploited in known vulnerability catalogs, the low CVSS score of 5.3 reflects limited confidentiality impact and the requirement for prior authentication, though the straightforward nature of the enumeration technique presents moderate real-world risk.