CVE-2022-48321 - Vulnerability Details

Vendors	Products
Checkmk	Checkmk

Link	Providers
https://checkmk.com/werk/14385
https://www.sonarsource.com/blog/checkmk-rce-chain-1/

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-48321", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "state": "PUBLISHED", "assignerShortName": "Tribe29", "dateReserved": "2023-02-08T08:46:54.800Z", "datePublished": "2023-02-20T16:54:44.369Z", "dateUpdated": "2024-08-03T15:10:59.655Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Checkmk", "vendor": "Tribe29", "versions": [{"lessThanOrEqual": "2.1.0p11", "status": "affected", "version": "2.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Stefan Schiller (SonarSource)"}], "descriptions": [{"lang": "en", "value": "Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API."}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"cvssV3_1": {"baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2023-10-24T12:48:50.741Z"}, "references": [{"url": "https://checkmk.com/werk/14385"}, {"url": "https://www.sonarsource.com/blog/checkmk-rce-chain-1/"}], "title": "SSRF in agent-receiver API"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:10:59.655Z"}, "title": "CVE Program Container", "references": [{"url": "https://checkmk.com/werk/14385", "tags": ["x_transferred"]}, {"url": "https://www.sonarsource.com/blog/checkmk-rce-chain-1/", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2022-48321 (string)

assignerOrgId : f7d6281c-4801-44ce-ace2-493291dedb0f (string)

state : PUBLISHED (string)

assignerShortName : Tribe29 (string)

dateReserved : 2023-02-08T08:46:54.800Z (string)

datePublished : 2023-02-20T16:54:44.369Z (string)

dateUpdated : 2024-08-03T15:10:59.655Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Checkmk (string)

vendor : Tribe29 (string)

versions : [ »

0 : { »

lessThanOrEqual : 2.1.0p11 (string)

status : affected (string)

version : 2.1.0 (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

value : Stefan Schiller (SonarSource) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-664 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-664 Server Side Request Forgery (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

baseScore : 6.8 (number)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-20 (string)

description : CWE-20 Improper Input Validation (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : f7d6281c-4801-44ce-ace2-493291dedb0f (string)

shortName : Checkmk (string)

dateUpdated : 2023-10-24T12:48:50.741Z (string)

}

references : [ »

0 : { »

url : https://checkmk.com/werk/14385 (string)

}

1 : { »

url : https://www.sonarsource.com/blog/checkmk-rce-chain-1/ (string)

}

]

title : SSRF in agent-receiver API (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T15:10:59.655Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://checkmk.com/werk/14385 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.sonarsource.com/blog/checkmk-rce-chain-1/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "1AE224D8-742B-4D1F-ABBE-3DDA3EA5C5AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b1:*:*:*:*:*:*", "matchCriteriaId": "1E6FCE7B-7ECE-42A4-82C5-12A647B0CCC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b2:*:*:*:*:*:*", "matchCriteriaId": "923AA113-D5E7-4F78-88BA-B72EF250F3EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b3:*:*:*:*:*:*", "matchCriteriaId": "B1984F57-A313-48AC-B8F9-F352D82824D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b4:*:*:*:*:*:*", "matchCriteriaId": "A38DB527-72A6-40B8-B46F-B8E78BFFDB1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b5:*:*:*:*:*:*", "matchCriteriaId": "67643E11-91A1-4580-BC4C-574074C862CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b6:*:*:*:*:*:*", "matchCriteriaId": "350B7E0F-D234-4D7C-91E4-F35E73579A24", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b7:*:*:*:*:*:*", "matchCriteriaId": "DE58ACA9-8078-46A7-8487-C06E4E38F372", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b8:*:*:*:*:*:*", "matchCriteriaId": "B3D8CF4D-E1F8-4D8D-A8A9-1783CAC869E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:b9:*:*:*:*:*:*", "matchCriteriaId": "58B0B051-7D3C-4EC7-96B0-38A1CC108D61", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p1:*:*:*:*:*:*", "matchCriteriaId": "B783A741-AAF2-43EE-8272-9239133A01E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p10:*:*:*:*:*:*", "matchCriteriaId": "A5F275A3-A99E-40E1-BD77-694FA568541F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p11:*:*:*:*:*:*", "matchCriteriaId": "3A44BF1A-5BE0-4412-B51D-055445758B61", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p2:*:*:*:*:*:*", "matchCriteriaId": "4DA8F776-A724-48FC-B7EF-13788BC69753", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p3:*:*:*:*:*:*", "matchCriteriaId": "076463AA-195F-4CD6-861B-72FE1C8A407F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p4:*:*:*:*:*:*", "matchCriteriaId": "63043834-98E5-47C2-91F1-41B98270ABCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p5:*:*:*:*:*:*", "matchCriteriaId": "FCF745D0-2EA6-4414-90BC-99D3ED08BB01", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p6:*:*:*:*:*:*", "matchCriteriaId": "4823087F-D7FA-4594-8FD3-412DE5EA1F02", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p7:*:*:*:*:*:*", "matchCriteriaId": "6429F9CE-D477-4CFF-B6E0-4BF11B61ED0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p8:*:*:*:*:*:*", "matchCriteriaId": "A50C58F9-94ED-4D85-8331-2D81F8E0760A", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.1.0:p9:*:*:*:*:*:*", "matchCriteriaId": "9A6AC0BD-FB65-4FAA-B344-66F87F16F8B3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API."}], "id": "CVE-2022-48321", "lastModified": "2024-11-21T07:33:09.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.7, "source": "security@checkmk.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-20T17:15:12.607", "references": [{"source": "security@checkmk.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://checkmk.com/werk/14385"}, {"source": "security@checkmk.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.sonarsource.com/blog/checkmk-rce-chain-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://checkmk.com/werk/14385"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.sonarsource.com/blog/checkmk-rce-chain-1/"}], "sourceIdentifier": "security@checkmk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@checkmk.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 1AE224D8-742B-4D1F-ABBE-3DDA3EA5C5AD (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b1:*:*:*:*:*:* (string)

matchCriteriaId : 1E6FCE7B-7ECE-42A4-82C5-12A647B0CCC8 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b2:*:*:*:*:*:* (string)

matchCriteriaId : 923AA113-D5E7-4F78-88BA-B72EF250F3EA (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b3:*:*:*:*:*:* (string)

matchCriteriaId : B1984F57-A313-48AC-B8F9-F352D82824D6 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b4:*:*:*:*:*:* (string)

matchCriteriaId : A38DB527-72A6-40B8-B46F-B8E78BFFDB1F (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b5:*:*:*:*:*:* (string)

matchCriteriaId : 67643E11-91A1-4580-BC4C-574074C862CB (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b6:*:*:*:*:*:* (string)

matchCriteriaId : 350B7E0F-D234-4D7C-91E4-F35E73579A24 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b7:*:*:*:*:*:* (string)

matchCriteriaId : DE58ACA9-8078-46A7-8487-C06E4E38F372 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b8:*:*:*:*:*:* (string)

matchCriteriaId : B3D8CF4D-E1F8-4D8D-A8A9-1783CAC869E4 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:b9:*:*:*:*:*:* (string)

matchCriteriaId : 58B0B051-7D3C-4EC7-96B0-38A1CC108D61 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p1:*:*:*:*:*:* (string)

matchCriteriaId : B783A741-AAF2-43EE-8272-9239133A01E8 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p10:*:*:*:*:*:* (string)

matchCriteriaId : A5F275A3-A99E-40E1-BD77-694FA568541F (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p11:*:*:*:*:*:* (string)

matchCriteriaId : 3A44BF1A-5BE0-4412-B51D-055445758B61 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p2:*:*:*:*:*:* (string)

matchCriteriaId : 4DA8F776-A724-48FC-B7EF-13788BC69753 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p3:*:*:*:*:*:* (string)

matchCriteriaId : 076463AA-195F-4CD6-861B-72FE1C8A407F (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p4:*:*:*:*:*:* (string)

matchCriteriaId : 63043834-98E5-47C2-91F1-41B98270ABCA (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p5:*:*:*:*:*:* (string)

matchCriteriaId : FCF745D0-2EA6-4414-90BC-99D3ED08BB01 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p6:*:*:*:*:*:* (string)

matchCriteriaId : 4823087F-D7FA-4594-8FD3-412DE5EA1F02 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p7:*:*:*:*:*:* (string)

matchCriteriaId : 6429F9CE-D477-4CFF-B6E0-4BF11B61ED0E (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p8:*:*:*:*:*:* (string)

matchCriteriaId : A50C58F9-94ED-4D85-8331-2D81F8E0760A (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:checkmk:checkmk:2.1.0:p9:*:*:*:*:*:* (string)

matchCriteriaId : 9A6AC0BD-FB65-4FAA-B344-66F87F16F8B3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API. (string)

}

]

id : CVE-2022-48321 (string)

lastModified : 2024-11-21T07:33:09.557 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 6.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.5 (number)

impactScore : 3.7 (number)

source : security@checkmk.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 3.3 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-02-20T17:15:12.607 (string)

references : [ »

0 : { »

source : security@checkmk.com (string)

tags : [ »

0 : Mitigation (string)

1 : Vendor Advisory (string)

]

url : https://checkmk.com/werk/14385 (string)

}

1 : { »

source : security@checkmk.com (string)

tags : [ »

0 : Exploit (string)

1 : Third Party Advisory (string)

]

url : https://www.sonarsource.com/blog/checkmk-rce-chain-1/ (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mitigation (string)

1 : Vendor Advisory (string)

]

url : https://checkmk.com/werk/14385 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Exploit (string)

1 : Third Party Advisory (string)

]

url : https://www.sonarsource.com/blog/checkmk-rce-chain-1/ (string)

}

]

sourceIdentifier : security@checkmk.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : security@checkmk.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-918 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object