cve-2024-8606
Vulnerability from cvelistv5
Published
2024-09-23 07:01
Modified
2024-09-23 15:33
Severity ?
9.2 (Critical) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Fix 2FA bypass via RestAPI
References
security@checkmk.comhttps://checkmk.com/werk/16218Vendor Advisory
Impacted products
Checkmk GmbHCheckmk
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "checkmk",
            "vendor": "checkmk",
            "versions": [
              {
                "lessThan": "2.3.0p16",
                "status": "affected",
                "version": "2.3.0",
                "versionType": "semver"
              },
              {
                "lessThan": "2.2.0p34",
                "status": "affected",
                "version": "2.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T15:32:23.848819Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T15:33:22.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Checkmk",
          "vendor": "Checkmk GmbH",
          "versions": [
            {
              "lessThan": "2.3.0p16",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.2.0p34",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bypass of two factor authentication in RestAPI in Checkmk \u003c 2.3.0p16 and \u003c 2.2.0p34 allows authenticated users to bypass two factor authentication"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115: Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-23T07:01:04.769Z",
        "orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
        "shortName": "Checkmk"
      },
      "references": [
        {
          "url": "https://checkmk.com/werk/16218"
        }
      ],
      "title": "Fix 2FA bypass via RestAPI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
    "assignerShortName": "Checkmk",
    "cveId": "CVE-2024-8606",
    "datePublished": "2024-09-23T07:01:04.769Z",
    "dateReserved": "2024-09-09T09:39:58.785Z",
    "dateUpdated": "2024-09-23T15:33:22.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8606\",\"sourceIdentifier\":\"security@checkmk.com\",\"published\":\"2024-09-23T07:15:02.233\",\"lastModified\":\"2024-09-30T15:32:34.647\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Bypass of two factor authentication in RestAPI in Checkmk \u003c 2.3.0p16 and \u003c 2.2.0p34 allows authenticated users to bypass two factor authentication\"},{\"lang\":\"es\",\"value\":\"La omisi\u00f3n de la autenticaci\u00f3n de dos factores en RestAPI en Checkmk \u0026lt; 2.3.0p16 y \u0026lt; 2.2.0p34 permite a los usuarios autenticados omitir la autenticaci\u00f3n de dos factores\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@checkmk.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"HIGH\",\"vulnerableSystemIntegrity\":\"HIGH\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]},{\"source\":\"security@checkmk.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"83202950-840A-4CB7-AD96-CE62E84FABD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"310A2FA2-633A-48FB-A5C2-9A9A922E72E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C0F1DC8-D9DF-4A7A-80DC-618FAB091375\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B0A1E3E-1B5A-4346-95BC-DE6FF6EE14CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB52B2A7-BDC1-4A4F-ABAF-69C1BA8E83C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F89225F-6969-4D89-B889-9CB09972825B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A1B23EA-4571-4E4E-80BC-FD76FFD83FFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*\",\"matchCriteriaId\":\"625A6998-5DAE-4538-9760-20523CCE501F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D1993E3-C4F9-4D78-BD02-A0B22D93BF1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"B28A0C9D-072A-413C-8587-CD57CB918190\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF22D0A7-82B1-4598-B8C5-BDFE523D07F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"20035AFB-75B4-4164-9833-A2FCAE24B577\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BCBACEB-7130-455D-B4BE-243053C116DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"156384E2-E04B-4153-A91F-3F307C9FEAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EEC0ED95-F43B-46D7-9AA0-A0FB1C32EF1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"91C194C1-5292-4E2A-BB71-9C5CD3CE6194\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C66704F1-0B5E-4B43-8748-987022F378F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FB7221E-BE9F-4529-8E07-8AD547FA3208\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:*\",\"matchCriteriaId\":\"30A074AD-9499-46E3-AB67-D6CEE3AA01C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8BD0240-A22B-4273-BD47-C35A8C12E127\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAA5680F-1DD0-48AA-BB7F-15B27365F0FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC2F31CA-D4EB-44E6-9A09-5255D33F4A88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD80BD69-20C6-4E17-B165-98689179A5A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p15:*:*:*:*:*:*\",\"matchCriteriaId\":\"B044D43B-0233-4A0D-A356-B9F9324E2777\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DE79896-EBE5-42F2-A126-2A871BBA1071\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p17:*:*:*:*:*:*\",\"matchCriteriaId\":\"51A44E69-EEA1-4B01-B7B3-5BF7B39819E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p18:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCB65AEB-CF52-410B-92B1-2DCFB914FFA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p19:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7E17FA6-9011-489C-9FA9-368CA2D86FAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BCEB6FF-668F-4313-9264-0BF021AFC45F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p20:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8B27218-A4FF-47BE-B578-6DB704478921\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p21:*:*:*:*:*:*\",\"matchCriteriaId\":\"8735357F-16A7-4408-9DDD-1C6796BADBE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p22:*:*:*:*:*:*\",\"matchCriteriaId\":\"4505098C-0A2B-481E-A3DF-D6DF8EFA4DE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p23:*:*:*:*:*:*\",\"matchCriteriaId\":\"C12AFCCF-014E-4EEB-8F04-F1ACE182BA98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p24:*:*:*:*:*:*\",\"matchCriteriaId\":\"66B85557-D5EC-4AF4-B97A-D2B80A58B3B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p25:*:*:*:*:*:*\",\"matchCriteriaId\":\"233ECD21-FA72-43AF-8E4C-DAC27CC18F3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p26:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B4DB8EE-C10A-4097-8E66-2932BAEB732E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p27:*:*:*:*:*:*\",\"matchCriteriaId\":\"8653402A-C5AA-4CB1-8742-A12CCBE59373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p28:*:*:*:*:*:*\",\"matchCriteriaId\":\"77047A82-E6D5-4E84-9BEC-ACD2FDA91FAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p29:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E44AE62-1746-410F-A28E-F8292E1F8D68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2342E2D-58B0-43E7-8C01-DF4678520F39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p30:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6C1AC39-5AE0-4FC8-93FF-966400B074F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p31:*:*:*:*:*:*\",\"matchCriteriaId\":\"68455233-52CD-44B8-8B02-D94BA84DA6A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p33:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AEF278D-D782-4A2B-B1B8-19A21D151AA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1871B646-CA69-477F-B113-B901AC7B3934\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"EEC65A72-CAE1-4E28-83EF-7ECAFE921BB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8FDECBC-8213-495F-A932-C4310F7C1F87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB49BC95-6AA8-4F53-A3D6-E199BF756AAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"050B6617-8FD4-47A6-BE4A-A52503A65812\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:checkmk:checkmk:2.2.0:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CA0FEC5-7036-47AF-A341-873B6C324B58\"}]}]}],\"references\":[{\"url\":\"https://checkmk.com/werk/16218\",\"source\":\"security@checkmk.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.