CVE-2024-8606

Published: Sep 23, 2024Modified: Sep 30, 2024

9.2

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@checkmk.com (Secondary)

Description

Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication

Affected (49)

Products: Checkmk: Checkmk

Checkmk

1 product

Checkmk

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Checkmk Checkmk	Version 2.3.0
Checkmk Checkmk	Version 2.3.0 p10
Checkmk Checkmk	Version 2.3.0 p11
Checkmk Checkmk	Version 2.3.0 p12
Checkmk Checkmk	Version 2.3.0 p13
Checkmk Checkmk	Version 2.3.0 p14
Checkmk Checkmk	Version 2.3.0 p15
Checkmk Checkmk	Version 2.3.0 p1
Checkmk Checkmk	Version 2.3.0 p2
Checkmk Checkmk	Version 2.3.0 p3
Checkmk Checkmk	Version 2.3.0 p4
Checkmk Checkmk	Version 2.3.0 p5
Checkmk Checkmk	Version 2.3.0 p6
Checkmk Checkmk	Version 2.3.0 p7
Checkmk Checkmk	Version 2.3.0 p8
Checkmk Checkmk	Version 2.3.0 p9

Configuration B

33 vulnerable

Vulnerable Software	Affected Versions
Checkmk Checkmk	Version 2.2.0
Checkmk Checkmk	Version 2.2.0 p10
Checkmk Checkmk	Version 2.2.0 p11
Checkmk Checkmk	Version 2.2.0 p12
Checkmk Checkmk	Version 2.2.0 p13
Checkmk Checkmk	Version 2.2.0 p14
Checkmk Checkmk	Version 2.2.0 p15
Checkmk Checkmk	Version 2.2.0 p16
Checkmk Checkmk	Version 2.2.0 p17
Checkmk Checkmk	Version 2.2.0 p18
Checkmk Checkmk	Version 2.2.0 p19
Checkmk Checkmk	Version 2.2.0 p1
Checkmk Checkmk	Version 2.2.0 p20
Checkmk Checkmk	Version 2.2.0 p21
Checkmk Checkmk	Version 2.2.0 p22
Checkmk Checkmk	Version 2.2.0 p23
Checkmk Checkmk	Version 2.2.0 p24
Checkmk Checkmk	Version 2.2.0 p25
Checkmk Checkmk	Version 2.2.0 p26
Checkmk Checkmk	Version 2.2.0 p27
Checkmk Checkmk	Version 2.2.0 p28
Checkmk Checkmk	Version 2.2.0 p29
Checkmk Checkmk	Version 2.2.0 p2
Checkmk Checkmk	Version 2.2.0 p30
Checkmk Checkmk	Version 2.2.0 p31
Checkmk Checkmk	Version 2.2.0 p33
Checkmk Checkmk	Version 2.2.0 p3
Checkmk Checkmk	Version 2.2.0 p4
Checkmk Checkmk	Version 2.2.0 p5
Checkmk Checkmk	Version 2.2.0 p6
Checkmk Checkmk	Version 2.2.0 p7
Checkmk Checkmk	Version 2.2.0 p8
Checkmk Checkmk	Version 2.2.0 p9

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://checkmk.com/werk/16218

Source: security@checkmk.com

Vendor Advisory

Timeline

No history available yet.