GCVE - cpe:2.3:a:tribe29:checkmk:1.6.0p10:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tribe29:checkmk:1.6.0p10:*:*:*:*:*:*:*

part: a version: 1.6.0p10 update: *

Vendor	Tribe29 (`19072b85-cddb-5c42-944d-c6d9fb49c288`)
Product	Checkmk (`ea48f31b-1c0b-5914-b817-86117d0caf33`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/tribe29/checkmk`	purl2cpe	2026-06-01 10:12:16.178702

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-1768`	vulnerable	2026-06-08 05:52:37.007440	Symmetric agent data encryption fails silently LOW (3.7) Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations. Published: 2023-04-04T06:30:29.538Z Updated: 2025-02-11T17:07:22.757Z Open on db.gcve.eu Reference links https://checkmk.com/werk/15423	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31258`	vulnerable	2026-06-08 05:43:40.660944	Details available HIGH (8.2) In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink. Published: 2022-05-20T22:02:46.000Z Updated: 2024-08-03T07:11:39.847Z Open on db.gcve.eu Reference links https://checkmk.com/werk/13902 https://forum.checkmk.com/c/announcements/18	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40906`	vulnerable	2026-06-08 05:35:19.353359	Details available CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication. Published: 2022-03-25T22:20:04.000Z Updated: 2026-07-09T00:14:50.239Z Open on db.gcve.eu Reference links https://github.com/Edgarloyola/CVE-2021-40906	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.