checkmk 2.4.0 Patch 22
Approved changes feed: RSS · Atom
cpe:2.3:a:checkmk:checkmk:2.4.0:p22:*:*:*:*:*:*
part: a version: 2.4.0 update: p22
| Vendor | Checkmk (4c044dbb-9ac1-5f9f-8fc3-779e7e40680c) |
|---|---|
| Product | Checkmk (d6ac166c-ac22-5bed-9805-e6ff22774734) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/tribe29/checkmk |
purl2cpe | 2026-06-01 10:16:57.795284 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3466 |
vulnerable | 2026-06-08 08:01:18.799137 |
Cross-site scripting in dashlet title
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
Published: 2026-04-07T12:08:50.132Z
Updated: 2026-04-22T12:26:27.839Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3103 |
vulnerable | 2026-06-08 08:01:17.845797 |
Deletion of passwords via RestApi
A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause data loss.
Published: 2026-03-04T13:15:41.086Z
Updated: 2026-03-04T14:07:12.933Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33457 |
vulnerable | 2026-06-08 07:59:10.109620 |
Potential livestatus injection in prediction graph page
Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value.
Published: 2026-04-10T08:31:35.768Z
Updated: 2026-04-14T13:29:41.112Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33456 |
vulnerable | 2026-06-08 07:59:10.038430 |
Potential livestatus injection in notification test
Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.
Published: 2026-04-10T08:31:27.807Z
Updated: 2026-04-14T13:29:54.362Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2859 |
vulnerable | 2026-06-08 07:55:17.727844 |
Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.
Published: 2026-03-13T09:40:43.743Z
Updated: 2026-03-13T15:48:18.690Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24097 |
vulnerable | 2026-06-08 07:51:17.129589 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24096 |
vulnerable | 2026-06-08 07:51:17.023489 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64998 |
vulnerable | 2026-06-08 07:39:20.577867 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-39666 |
vulnerable | 2026-06-08 07:23:07.024720 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.