GCVE - cpe:2.3:a:checkmk:checkmk:2.3.0:p43:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:checkmk:checkmk:2.3.0:p43:*:*:*:*:*:*

part: a version: 2.3.0 update: p43

Vendor	Checkmk (`4c044dbb-9ac1-5f9f-8fc3-779e7e40680c`)
Product	Checkmk (`d6ac166c-ac22-5bed-9805-e6ff22774734`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/tribe29/checkmk`	purl2cpe	2026-06-01 10:16:57.776902

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3466`	vulnerable	2026-06-08 08:01:18.794036	Cross-site scripting in dashlet title Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard. Published: 2026-04-07T12:08:50.132Z Updated: 2026-04-22T12:26:27.839Z Open on db.gcve.eu Reference links https://checkmk.com/werk/19033 https://checkmk.com/werk/19583 https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33457`	vulnerable	2026-06-08 07:59:10.100556	Potential livestatus injection in prediction graph page Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value. Published: 2026-04-10T08:31:35.768Z Updated: 2026-04-14T13:29:41.112Z Open on db.gcve.eu Reference links https://checkmk.com/werk/17990	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-64998`	vulnerable	2026-06-08 07:39:20.567948	Session hijacking via exposed session signing secret in distributed Checkmk setups Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies. Published: 2026-03-24T11:25:58.183Z Updated: 2026-03-25T03:55:50.621Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18954	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-39666`	vulnerable	2026-06-08 07:23:07.008800	omd: Local privilege escalation when executing omd commands as root Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root. Published: 2026-04-07T12:09:07.609Z Updated: 2026-04-07T13:18:19.609Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18891	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.