CVE-2024-1742 - OpenCVE

Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://checkmk.com/werk/16234

History

No history.

MITRE

Status: PUBLISHED

Assigner: Checkmk

Published: 2024-03-22T10:26:06.238Z

Updated: 2024-08-12T18:34:37.823Z

Reserved: 2024-02-22T12:43:58.785Z

Link: CVE-2024-1742

Vulnrichment

Updated: 2024-08-01T18:48:21.919Z

NVD

Status : Awaiting Analysis

Published: 2024-03-22T11:15:46.457

Modified: 2024-03-22T12:45:36.130

Link: CVE-2024-1742

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1742", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "state": "PUBLISHED", "assignerShortName": "Checkmk", "dateReserved": "2024-02-22T12:43:58.785Z", "datePublished": "2024-03-22T10:26:06.238Z", "dateUpdated": "2024-08-12T18:34:37.823Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Checkmk", "vendor": "Checkmk GmbH", "versions": [{"lessThan": "2.3.0b4", "status": "affected", "version": "2.3.0", "versionType": "semver"}, {"lessThan": "2.2.0p24", "status": "affected", "version": "2.2.0", "versionType": "semver"}, {"lessThan": "2.1.0p41", "status": "affected", "version": "2.1.0", "versionType": "semver"}, {"lessThanOrEqual": "2.0.0p39", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list."}], "impacts": [{"capecId": "CAPEC-150", "descriptions": [{"lang": "en", "value": "CAPEC-150: Collect Data from Common Resource Locations"}]}], "metrics": [{"cvssV3_1": {"baseScore": 3.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-214", "description": "CWE-214: Invocation of Process Using Visible Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2024-03-22T10:26:06.238Z"}, "references": [{"url": "https://checkmk.com/werk/16234"}], "title": "Information disclosure in mk_oracle Checkmk agent plugin"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.919Z"}, "title": "CVE Program Container", "references": [{"url": "https://checkmk.com/werk/16234", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "checkmk", "product": "checkmk", "cpes": ["cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "2.3.0", "status": "affected", "lessThan": "2.3.0b4", "versionType": "semver"}, {"version": "2.2.0", "status": "affected", "lessThan": "2.2.0p24", "versionType": "semver"}, {"version": "2.1.0", "status": "affected", "lessThan": "2.1.0p41", "versionType": "semver"}, {"version": "2.0.0", "status": "affected", "lessThan": "2.0.0p39", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-28T19:12:10.406234Z", "id": "CVE-2024-1742", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T18:34:37.823Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://checkmk.com/werk/16234", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.919Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1742", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-28T19:12:10.406234Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*"], "vendor": "checkmk", "product": "checkmk", "versions": [{"status": "affected", "version": "2.3.0", "lessThan": "2.3.0b4", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0p24", "versionType": "semver"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0p41", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0p39", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T18:34:32.005Z"}}], "cna": {"title": "Information disclosure in mk_oracle Checkmk agent plugin", "impacts": [{"capecId": "CAPEC-150", "descriptions": [{"lang": "en", "value": "CAPEC-150: Collect Data from Common Resource Locations"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "Checkmk GmbH", "product": "Checkmk", "versions": [{"status": "affected", "version": "2.3.0", "lessThan": "2.3.0b4", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0p24", "versionType": "semver"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0p41", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.0p39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://checkmk.com/werk/16234"}], "descriptions": [{"lang": "en", "value": "Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-214", "description": "CWE-214: Invocation of Process Using Visible Sensitive Information"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2024-03-22T10:26:06.238Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1742", "state": "PUBLISHED", "dateUpdated": "2024-08-12T18:34:37.823Z", "dateReserved": "2024-02-22T12:43:58.785Z", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "datePublished": "2024-03-22T10:26:06.238Z", "assignerShortName": "Checkmk"}, "dataVersion": "5.1"}