CVE-2025-32918
Livestatus injection in autocomplete endpoint
Summary
Livestatus injection in autocomplete endpoint
Original description
The description as published by the source.
Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.
References
- advisory github.com
- advisory nvd.nist.gov
- web checkmk.com