CVE-2023-2020: Unauthorized scheduling of downtimes via REST API
Published Apr 18, 2023
·Updated
Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.
Affected Software
82 affected components
CheckMK Checkmk=2.1.0
CheckMK Checkmk=2.1.0-b1
CheckMK Checkmk=2.1.0-b2
CheckMK Checkmk=2.1.0-b3
CheckMK Checkmk=2.1.0-b4
CheckMK Checkmk=2.1.0-b5
CheckMK Checkmk=2.1.0-b6
CheckMK Checkmk=2.1.0-b7
CheckMK Checkmk=2.1.0-b8
CheckMK Checkmk=2.1.0-b9
CheckMK Checkmk=2.1.0-p1
CheckMK Checkmk=2.1.0-p10
CheckMK Checkmk=2.1.0-p11
CheckMK Checkmk=2.1.0-p12
CheckMK Checkmk=2.1.0-p13
CheckMK Checkmk=2.1.0-p14
CheckMK Checkmk=2.1.0-p15
CheckMK Checkmk=2.1.0-p16
CheckMK Checkmk=2.1.0-p17
CheckMK Checkmk=2.1.0-p18
CheckMK Checkmk=2.1.0-p2
CheckMK Checkmk=2.1.0-p20
CheckMK Checkmk=2.1.0-p21
CheckMK Checkmk=2.1.0-p22
CheckMK Checkmk=2.1.0-p23
CheckMK Checkmk=2.1.0-p24
CheckMK Checkmk=2.1.0-p25
CheckMK Checkmk=2.1.0-p26
CheckMK Checkmk=2.1.0-p27
CheckMK Checkmk=2.1.0-p3
CheckMK Checkmk=2.1.0-p4
CheckMK Checkmk=2.1.0-p5
CheckMK Checkmk=2.1.0-p6
CheckMK Checkmk=2.1.0-p7
CheckMK Checkmk=2.1.0-p8
CheckMK Checkmk=2.1.0-p9
CheckMK Checkmk=2.2.0-b1
CheckMK Checkmk=2.2.0-b2
CheckMK Checkmk=2.2.0-b3
CheckMK Checkmk=2.2.0-b4
CheckMK Checkmk=2.2.0-i1
Tribe29 Checkmk=2.1.0
Tribe29 Checkmk=2.1.0-b1
Tribe29 Checkmk=2.1.0-b2
Tribe29 Checkmk=2.1.0-b3
Tribe29 Checkmk=2.1.0-b4
Tribe29 Checkmk=2.1.0-b5
Tribe29 Checkmk=2.1.0-b6
Tribe29 Checkmk=2.1.0-b7
Tribe29 Checkmk=2.1.0-b8
Tribe29 Checkmk=2.1.0-b9
Tribe29 Checkmk=2.1.0-p1
Tribe29 Checkmk=2.1.0-p10
Tribe29 Checkmk=2.1.0-p11
Tribe29 Checkmk=2.1.0-p12
Tribe29 Checkmk=2.1.0-p13
Tribe29 Checkmk=2.1.0-p14
Tribe29 Checkmk=2.1.0-p15
Tribe29 Checkmk=2.1.0-p16
Tribe29 Checkmk=2.1.0-p17
Tribe29 Checkmk=2.1.0-p18
Tribe29 Checkmk=2.1.0-p2
Tribe29 Checkmk=2.1.0-p20
Tribe29 Checkmk=2.1.0-p21
Tribe29 Checkmk=2.1.0-p22
Tribe29 Checkmk=2.1.0-p23
Tribe29 Checkmk=2.1.0-p24
Tribe29 Checkmk=2.1.0-p25
Tribe29 Checkmk=2.1.0-p26
Tribe29 Checkmk=2.1.0-p27
Tribe29 Checkmk=2.1.0-p3
Tribe29 Checkmk=2.1.0-p4
Tribe29 Checkmk=2.1.0-p5
Tribe29 Checkmk=2.1.0-p6
Tribe29 Checkmk=2.1.0-p7
Tribe29 Checkmk=2.1.0-p8
Tribe29 Checkmk=2.1.0-p9
Tribe29 Checkmk=2.2.0-b1
Tribe29 Checkmk=2.2.0-b2
Tribe29 Checkmk=2.2.0-b3
Tribe29 Checkmk=2.2.0-b4
Tribe29 Checkmk=2.2.0-i1
Event History
Apr 18, 2023
CVE Published
via MITRE·11:09 AM
Data Sourced
via MITRE·11:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-2020?
CVE-2023-2020 is a vulnerability in Tribe29 Checkmk versions 2.1.0p27 and 2.2.0b4 that allows unauthorized users to schedule downtimes for any host.
2
What is the severity of CVE-2023-2020?
The severity of CVE-2023-2020 is medium, with a severity value of 4.3.
3
How does CVE-2023-2020 affect Tribe29 Checkmk?
CVE-2023-2020 affects Tribe29 Checkmk versions 2.1.0p27 and 2.2.0b4.
4
How can unauthorized users exploit CVE-2023-2020?
Unauthorized users can exploit CVE-2023-2020 to schedule downtimes for any host using the REST API in Tribe29 Checkmk versions 2.1.0p27 and 2.2.0b4.
5
Is there a fix for CVE-2023-2020?
Yes, there is a fix for CVE-2023-2020. It is recommended to update Tribe29 Checkmk to a version higher than 2.2.0b4 or 2.1.0p27.