CVE-2022-46836: critical vulnerability in Tribe29 Checkmk
PHP code injection in watolib
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 1.1%
PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Affected products
Tribe29 · CheckmkRelated CVEs — Tribe29 Checkmk
In the same product, most dangerous first.
CVE-2022-46303HIGHCommand injection in SMS notificationsEPSS 1.1%CVE-2023-0284MEDIUMImproper validation of LDAP user IDsEPSS 1.0%CVE-2023-1768LOWSymmetric agent data encryption fails silentlyEPSS 0.9%CVE-2023-22359MEDIUMUser-enumeration in RestAPIEPSS 0.5%CVE-2022-4884LOWPath-Traversal in MKP storingEPSS 0.5%CVE-2022-48318MEDIUMInsecure access control mechanisms for RestAPI documentationEPSS 0.5%