CVE-2023-22359: User-enumeration in RestAPI
Published Jun 26, 2023
·Updated
User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.
Affected Software
28 affected components
Tribe29 Checkmk=2.2.0
Tribe29 Checkmk=2.2.0-b1
Tribe29 Checkmk=2.2.0-b2
Tribe29 Checkmk=2.2.0-b3
Tribe29 Checkmk=2.2.0-b4
Tribe29 Checkmk=2.2.0-b5
Tribe29 Checkmk=2.2.0-b6
Tribe29 Checkmk=2.2.0-b7
Tribe29 Checkmk=2.2.0-b8
Tribe29 Checkmk=2.2.0-i1
Tribe29 Checkmk=2.2.0-p1
Tribe29 Checkmk=2.2.0-p2
Tribe29 Checkmk=2.2.0-p3
Tribe29 Checkmk=2.2.0-p4
CheckMK Checkmk=2.2.0
CheckMK Checkmk=2.2.0-b1
CheckMK Checkmk=2.2.0-b2
CheckMK Checkmk=2.2.0-b3
CheckMK Checkmk=2.2.0-b4
CheckMK Checkmk=2.2.0-b5
CheckMK Checkmk=2.2.0-b6
CheckMK Checkmk=2.2.0-b7
CheckMK Checkmk=2.2.0-b8
CheckMK Checkmk=2.2.0-i1
CheckMK Checkmk=2.2.0-p1
CheckMK Checkmk=2.2.0-p2
CheckMK Checkmk=2.2.0-p3
CheckMK Checkmk=2.2.0-p4
Event History
Jun 26, 2023
CVE Published
via MITRE·06:51 AM
Data Sourced
via MITRE·06:51 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-22359?
CVE-2023-22359 is a vulnerability in Checkmk <=2.2.0p4 that allows an authenticated attacker to enumerate usernames.
2
How severe is CVE-2023-22359?
CVE-2023-22359 has a severity rating of medium with a CVSS score of 4.3.
3
Which versions of Checkmk are affected by CVE-2023-22359?
Checkmk versions 2.2.0 up to and including 2.2.0p4 are affected by CVE-2023-22359.
4
How can an attacker exploit CVE-2023-22359?
An authenticated attacker can exploit CVE-2023-22359 to enumerate usernames in Checkmk.
5
Is there a fix for CVE-2023-22359?
Yes, a fix for CVE-2023-22359 is available. It is recommended to update to a version of Checkmk that is not affected by the vulnerability.