OpenCVE

Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Checkmk	Checkmk

No data.

No data.

References

Link	Providers
https://checkmk.com/werk/16232

History

No history.

MITRE

Status: PUBLISHED

Assigner: Checkmk

Published: 2024-03-22T10:25:35.675Z

Updated: 2024-08-02T14:54:20.182Z

Reserved: 2024-01-17T09:09:03.629Z

Link: CVE-2024-0638

Vulnrichment

Updated: 2024-08-02T14:54:14.042Z

NVD

Status : Awaiting Analysis

Published: 2024-03-22T11:15:46.183

Modified: 2024-11-21T08:47:02.853

Link: CVE-2024-0638

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0638", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "state": "PUBLISHED", "assignerShortName": "Checkmk", "dateReserved": "2024-01-17T09:09:03.629Z", "datePublished": "2024-03-22T10:25:35.675Z", "dateUpdated": "2024-08-02T14:54:20.182Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Checkmk", "vendor": "Checkmk GmbH", "versions": [{"lessThan": "2.3.0b4", "status": "affected", "version": "2.3.0", "versionType": "semver"}, {"lessThan": "2.2.0p24", "status": "affected", "version": "2.2.0", "versionType": "semver"}, {"lessThan": "2.1.0p41", "status": "affected", "version": "2.1.0", "versionType": "semver"}, {"lessThanOrEqual": "2.0.0p39", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-272", "description": "CWE-272: Least Privilege Violation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2024-03-22T10:25:35.675Z"}, "references": [{"url": "https://checkmk.com/werk/16232"}], "title": "Privilege escalation in mk_oracle plugins"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:11:35.679Z"}, "title": "CVE Program Container", "references": [{"url": "https://checkmk.com/werk/16232", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "checkmk", "product": "checkmk", "cpes": ["cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.3.0", "status": "affected", "lessThan": "2.3.0b4", "versionType": "semver"}, {"version": "2.2.0", "status": "affected", "lessThan": "2.2.0p24", "versionType": "semver"}, {"version": "2.1.0", "status": "affected", "lessThan": "2.1.0p41", "versionType": "semver"}, {"version": "2.0.0", "status": "affected", "lessThan": "2.0.0p39", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T14:50:20.039040Z", "id": "CVE-2024-0638", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T14:54:20.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-02T14:50:20.039040Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*"], "vendor": "checkmk", "product": "checkmk", "versions": [{"status": "affected", "version": "2.3.0", "lessThan": "2.3.0b4", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0p24", "versionType": "semver"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0p41", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0p39", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-08-02T14:54:14.042Z"}}], "cna": {"title": "Privilege escalation in mk_oracle plugins", "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "Checkmk GmbH", "product": "Checkmk", "versions": [{"status": "affected", "version": "2.3.0", "lessThan": "2.3.0b4", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0p24", "versionType": "semver"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0p41", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.0p39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://checkmk.com/werk/16232"}], "descriptions": [{"lang": "en", "value": "Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-272", "description": "CWE-272: Least Privilege Violation"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2024-03-22T10:25:35.675Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0638", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:11:35.679Z", "dateReserved": "2024-01-17T09:09:03.629Z", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "datePublished": "2024-03-22T10:25:35.675Z", "assignerShortName": "Checkmk"}, "dataVersion": "5.1"}