Vulnerabilities > Tribe29
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-04-18 | CVE-2023-2020 | Incorrect Authorization vulnerability in Tribe29 Checkmk 2.1.0/2.2.0 Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. | 4.3 |
| 2023-03-20 | CVE-2023-22288 | Cross-site Scripting vulnerability in Tribe29 Checkmk HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails | 5.4 |
| 2023-02-20 | CVE-2022-46303 | OS Command Injection vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions. | 7.5 |
| 2023-02-20 | CVE-2022-46836 | Code Injection vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component. | 8.8 |
| 2023-02-20 | CVE-2022-47909 | Unspecified vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost. | 7.8 |
| 2023-02-20 | CVE-2022-48317 | Insufficient Session Expiration vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI. | 9.8 |
| 2023-02-20 | CVE-2022-48318 | Missing Authorization vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation. | 5.3 |
| 2023-02-20 | CVE-2022-48319 | Information Exposure Through Log Files vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file. | 5.5 |
| 2023-02-20 | CVE-2022-48320 | Cross-Site Request Forgery (CSRF) vulnerability in Tribe29 Checkmk 2.0.0/2.1.0 Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages. | 4.3 |
| 2023-02-20 | CVE-2022-48321 | Server-Side Request Forgery (SSRF) vulnerability in Tribe29 Checkmk 2.1.0 Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API. | 3.3 |