Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2023-2020

Unauthorized scheduling of downtimes via REST API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Tribe29

Description

Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Tribe29 Checkmk

Default version status: unaffected

  • 2.2.0 to ≤ 2.2.0b4affected
  • 2.1.0 to ≤ 2.1.0p27affected

References