CVE-2025-3506: Potentially senitive path exposed via unauthenticated http route
Published May 8, 2025
·Updated
Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to access files that could contain secrets.
Affected Software
8 affected components
Checkmk Checkmk>=2.1.0<2.4.0b6
Checkmk Checkmk>=2.1.0<=2.3.0
Checkmk Checkmk=2.4.0
Checkmk Checkmk=2.4.0-b1
Checkmk Checkmk=2.4.0-b2
Checkmk Checkmk=2.4.0-b3
Checkmk Checkmk=2.4.0-b4
Checkmk Checkmk=2.4.0-b5
Event History
May 8, 2025
CVE Published
via MITRE·11:24 AM
Data Sourced
via MITRE·11:24 AM
DescriptionWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-3506?
CVE-2025-3506 has been rated as a medium severity vulnerability due to unauthorized file access.
2
How do I fix CVE-2025-3506?
To fix CVE-2025-3506, upgrade to Checkmk version 2.4.0b7 or later to mitigate the vulnerability.
3
What are the potential risks associated with CVE-2025-3506?
CVE-2025-3506 allows attackers to access sensitive files that may contain secrets, leading to potential data breaches.
4
Which versions of Checkmk are affected by CVE-2025-3506?
CVE-2025-3506 affects Checkmk versions 2.1.0, 2.2.0, 2.3.0, and up to 2.4.0b6.
5
Is authentication required to exploit CVE-2025-3506?
No, CVE-2025-3506 can be exploited without authentication, making it particularly dangerous.