GCVE - cpe:2.3:a:checkmk:checkmk:2.4.0:p23:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:checkmk:checkmk:2.4.0:p23:*:*:*:*:*:*

part: a version: 2.4.0 update: p23

Vendor	Checkmk (`4c044dbb-9ac1-5f9f-8fc3-779e7e40680c`)
Product	Checkmk (`d6ac166c-ac22-5bed-9805-e6ff22774734`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/tribe29/checkmk`	purl2cpe	2026-06-01 10:16:57.795285

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3466`	vulnerable	2026-06-08 08:01:18.804163	Cross-site scripting in dashlet title Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard. Published: 2026-04-07T12:08:50.132Z Updated: 2026-04-22T12:26:27.839Z Open on db.gcve.eu Reference links https://checkmk.com/werk/19033 https://checkmk.com/werk/19583 https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33457`	vulnerable	2026-06-08 07:59:10.109640	Potential livestatus injection in prediction graph page Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value. Published: 2026-04-10T08:31:35.768Z Updated: 2026-04-14T13:29:41.112Z Open on db.gcve.eu Reference links https://checkmk.com/werk/17990	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33456`	vulnerable	2026-06-08 07:59:10.039430	Potential livestatus injection in notification test Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description. Published: 2026-04-10T08:31:27.807Z Updated: 2026-04-14T13:29:54.362Z Open on db.gcve.eu Reference links https://checkmk.com/werk/17989	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24096`	vulnerable	2026-06-08 07:51:17.024400	Insufficient permission validation on multiple REST API Quick Setup endpoints Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information Published: 2026-04-01T10:07:21.670Z Updated: 2026-04-01T12:37:04.819Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18989	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-39666`	vulnerable	2026-06-08 07:23:07.025565	omd: Local privilege escalation when executing omd commands as root Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root. Published: 2026-04-07T12:09:07.609Z Updated: 2026-04-07T13:18:19.609Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18891	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.