checkmk 2.3.0 Patch 25

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:checkmk:checkmk:2.3.0:p25:*:*:*:*:*:*

part: a version: 2.3.0 update: p25

VendorCheckmk (4c044dbb-9ac1-5f9f-8fc3-779e7e40680c)
ProductCheckmk (d6ac166c-ac22-5bed-9805-e6ff22774734)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/tribe29/checkmk purl2cpe 2026-06-01 10:16:57.776875

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-3466 vulnerable 2026-06-08 08:01:18.785494 Cross-site scripting in dashlet title
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
Published: 2026-04-07T12:08:50.132Z
Updated: 2026-04-22T12:26:27.839Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-3103 vulnerable 2026-06-08 08:01:17.791598 Deletion of passwords via RestApi
A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause data loss.
Published: 2026-03-04T13:15:41.086Z
Updated: 2026-03-04T14:07:12.933Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33457 vulnerable 2026-06-08 07:59:10.081911 Potential livestatus injection in prediction graph page
Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value.
Published: 2026-04-10T08:31:35.768Z
Updated: 2026-04-14T13:29:41.112Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-2859 vulnerable 2026-06-08 07:55:17.692978 Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.
Published: 2026-03-13T09:40:43.743Z
Updated: 2026-03-13T15:48:18.690Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-24097 vulnerable 2026-06-08 07:51:17.105752 Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.
Published: 2026-03-13T09:40:05.075Z
Updated: 2026-03-13T15:56:41.327Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-65000 vulnerable 2026-06-08 07:39:20.601035 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64999 vulnerable 2026-06-08 07:39:20.580930 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64998 vulnerable 2026-06-08 07:39:20.558090 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64997 vulnerable 2026-06-08 07:39:20.496884 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64996 vulnerable 2026-06-08 07:39:20.454944 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-39666 vulnerable 2026-06-08 07:23:06.998269 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-39664 vulnerable 2026-06-08 07:23:06.937839 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-39663 vulnerable 2026-06-08 07:23:06.859175 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-32919 vulnerable 2026-06-08 07:19:01.155159 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-32918 vulnerable 2026-06-08 07:19:01.145630 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-32917 vulnerable 2026-06-08 07:19:01.123074 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-32916 vulnerable 2026-06-08 07:19:01.091395 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-32915 vulnerable 2026-06-08 07:19:01.059142 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-2596 vulnerable 2026-06-08 07:16:57.803540 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-2092 vulnerable 2026-06-08 07:14:57.999348 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-1712 vulnerable 2026-06-08 07:08:37.868444 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-1075 vulnerable 2026-06-08 07:06:36.869870 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.