GCVE - cpe:2.3:a:checkmk:checkmk:2.2.0:p46:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:checkmk:checkmk:2.2.0:p46:*:*:*:*:*:*

part: a version: 2.2.0 update: p46

Vendor	Checkmk (`4c044dbb-9ac1-5f9f-8fc3-779e7e40680c`)
Product	Checkmk (`d6ac166c-ac22-5bed-9805-e6ff22774734`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/tribe29/checkmk`	purl2cpe	2026-06-01 10:16:57.776834

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3466`	vulnerable	2026-06-08 08:01:18.774601	Cross-site scripting in dashlet title Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard. Published: 2026-04-07T12:08:50.132Z Updated: 2026-04-22T12:26:27.839Z Open on db.gcve.eu Reference links https://checkmk.com/werk/19033 https://checkmk.com/werk/19583 https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2859`	vulnerable	2026-06-08 07:55:17.666516	Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure. Published: 2026-03-13T09:40:43.743Z Updated: 2026-03-13T15:48:18.690Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18994	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24097`	vulnerable	2026-06-08 07:51:17.076012	Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure. Published: 2026-03-13T09:40:05.075Z Updated: 2026-03-13T15:56:41.327Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18993	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-64998`	vulnerable	2026-06-08 07:39:20.553167	Session hijacking via exposed session signing secret in distributed Checkmk setups Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies. Published: 2026-03-24T11:25:58.183Z Updated: 2026-03-25T03:55:50.621Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18954	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-39666`	vulnerable	2026-06-08 07:23:06.983306	omd: Local privilege escalation when executing omd commands as root Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root. Published: 2026-04-07T12:09:07.609Z Updated: 2026-04-07T13:18:19.609Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18891	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.