Checkmkの脆弱性3件 コード実行の恐れ、修正版あり
Summary
Checkmkに、サイトユーザー権限でコードを実行される脆弱性が3件公表されました。2.5系と2.4系は2.5.0p19か2.4.0p40へ更新し、修正版が出ない2.3.0は移行が必要です。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Checkmkに、サイトユーザー権限でコードを実行される脆弱性が3件公表されました。2.5系と2.4系は2.5.0p19か2.4.0p40へ更新し、修正版が出ない2.3.0は移行が必要です。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Checkmk GmbHCheckmk |
≥ 2.5.0, < 2.5.0p19→ 2.5.0p19 ≥ 2.4.0, < 2.4.0p40→ 2.4.0p40 |
2.5.0p19 2.4.0p40 |
Original description The description as published by the source.
Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory checkmk.com
- web checkmk.com
- web nvd.nist.gov
- web github.com