CVE-2024-47094: Detailed Vulnerability Analysis and Overview

CVE-2024-47094 Vulnerability Summary

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.

CVE-2024-47094: Detailed Information and External References

EPSS

0.00043

EPSS %

0.10702

References

0.00043

• https://checkmk.com/werk/17342

CWE

CWE-532

CAPEC

0.00043

• Fuzzing for application mapping: An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.

Vulnerable Configurations

• cpe:2.3:a:checkmk:checkmk:2.1.0:*:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:-:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:-:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b1:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b1:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b2:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b2:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b3:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b3:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b4:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b4:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b5:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b5:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b6:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b6:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b7:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b7:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:b8:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:b8:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:i1:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:i1:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p1:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p1:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p15:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p15:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p17:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p17:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p18:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p18:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p19:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p19:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p2:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p2:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p20:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p20:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p21:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p21:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p22:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p22:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p23:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p23:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p24:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p24:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p25:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p25:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p26:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p26:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p27:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p27:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p28:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p28:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p29:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p29:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p3:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p3:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p30:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p30:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p31:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p31:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p32:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p32:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p33:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p33:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p34:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p34:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p35:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p35:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p36:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p36:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p4:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p4:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p5:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p5:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p6:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p6:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p7:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p7:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p8:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p8:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.2.0:p9:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.2.0:p9:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:b1:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:b1:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:b2:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:b2:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:b3:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:b3:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:b4:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:b4:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:b5:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:b5:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:b6:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:b6:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p16:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p16:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p17:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p17:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p18:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p18:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p19:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p19:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p20:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p20:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p21:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p21:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*
• cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*
  cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*

CVSS3 Source

nvd@nist.gov

CVSS3 Type

Primary

CVSS3 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N