CVE-2023-31210 - Vulnerability Details - OpenCVE

Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00122.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Checkmk	Checkmk

Configuration 1 [-]

OR	cpe:2.3:a:checkmk:checkmk:2.2.0:p10::::::
	cpe:2.3:a:checkmk:checkmk:2.2.0:p11::::::
	cpe:2.3:a:checkmk:checkmk:2.2.0:p12::::::
	cpe:2.3:a:checkmk:checkmk:2.2.0:p13::::::
	cpe:2.3:a:checkmk:checkmk:2.2.0:p14::::::
	cpe:2.3:a:checkmk:checkmk:2.2.0:p15::::::
	cpe:2.3:a:checkmk:checkmk:2.2.0:p16::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://checkmk.com/werk/16226

History

Mon, 02 Dec 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Checkmk

Published: 2023-12-13T08:26:46.452Z

Updated: 2024-12-02T14:29:06.806Z

Reserved: 2023-04-25T08:49:15.443Z

Link: CVE-2023-31210

Vulnrichment

Updated: 2024-08-02T14:53:29.719Z

NVD

Status : Modified

Published: 2023-12-13T09:15:34.080

Modified: 2024-11-21T08:01:37.843

Link: CVE-2023-31210

Redhat

No data.

OpenCVE Enrichment

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:*", "matchCriteriaId": "30A074AD-9499-46E3-AB67-D6CEE3AA01C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:*", "matchCriteriaId": "A8BD0240-A22B-4273-BD47-C35A8C12E127", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:*", "matchCriteriaId": "DAA5680F-1DD0-48AA-BB7F-15B27365F0FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:*", "matchCriteriaId": "BC2F31CA-D4EB-44E6-9A09-5255D33F4A88", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:*", "matchCriteriaId": "CD80BD69-20C6-4E17-B165-98689179A5A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p15:*:*:*:*:*:*", "matchCriteriaId": "B044D43B-0233-4A0D-A356-B9F9324E2777", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:*", "matchCriteriaId": "7DE79896-EBE5-42F2-A126-2A871BBA1071", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries"}, {"lang": "es", "value": "El uso de LD_LIBRARY_PATH controlado por el usuario en el agente en Checkmk 2.2.0p10 hasta 2.2.0p16 permite a un usuario malicioso del sitio Checkmk escalar derechos mediante la inyecci\u00f3n de librer\u00edas maliciosas"}], "id": "CVE-2023-31210", "lastModified": "2024-11-21T08:01:37.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@checkmk.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-13T09:15:34.080", "references": [{"source": "security@checkmk.com", "tags": ["Vendor Advisory"], "url": "https://checkmk.com/werk/16226"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://checkmk.com/werk/16226"}], "sourceIdentifier": "security@checkmk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "security@checkmk.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}