CVE-2025-32918
Livestatus injection in autocomplete endpoint
Résumé
Livestatus injection in autocomplete endpoint
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.
Références
- advisory github.com
- advisory nvd.nist.gov
- web checkmk.com