The vulnerability arises from inadequate sanitization of the service description field on the prediction graph page, allowing an authenticated user to inject arbitrary Livestatus commands. This could let the attacker execute unintended commands within the Checkmk environment, potentially exposing sensitive monitoring data or manipulating the system’s state, thereby compromising data integrity and confidentiality. The weakness aligns with a command injection attack.

The affected product is Checkmk by Checkmk GmbH. Versions before 2.5.0b4, before 2.4.0p26, and before 2.3.0p47 are vulnerable. It specifically affects the prediction graph interface where service names are processed.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated Checkmk session and manipulation of the service name parameter; once achieved, arbitrary Livestatus commands can be executed. The risk of exploitation is moderate and depends on attacker access to a valid user account.