CVE-2022-46303

HIGH

Tribe29 Checkmk <2.1.0p10-<1.6.0p29 - Command Injection

Title source: llm
STIX 2.1

Description

Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions.

References (1)

Core 1
Core References
Mitigation, Vendor Advisory
https://checkmk.com/werk/14381

Scores

CVSS v3 8.0
EPSS 0.0110
EPSS Percentile 61.4%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-20 CWE-78
Status published
Products (2)
checkmk/checkmk 2.1.0 (20 CPE variants)
checkmk/checkmk 2.0.0 (30 CPE variants)
Published Feb 20, 2023
Tracked Since Feb 18, 2026