CVE-2023-31207

Summary

Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.

Affected Software

VendorProductVersion RangeStatus
Tribe29Checkmk2.2.0 <= 2.2.0b6affected
Tribe29Checkmk2.1.0 <= 2.1.0p26affected
Tribe29Checkmk2.0.0 <= 2.0.0p35affected

Weaknesses

  • CWE-532: CWE-532: Insertion of Sensitive Information into Log File

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References