CVE-2025-64997: Insufficient permission validation when showing agent information
Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.4.0p17 - Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.3.0p42
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64997?
CVE-2025-64997 has a medium severity rating due to the potential for information disclosure.
How do I fix CVE-2025-64997?
To fix CVE-2025-64997, upgrade to Checkmk versions 2.4.0p17 or 2.3.0p42 or later.
What is the impact of CVE-2025-64997?
The impact of CVE-2025-64997 allows low-privileged users to access agent information via the REST API.
Which versions of Checkmk are affected by CVE-2025-64997?
CVE-2025-64997 affects Checkmk versions prior to 2.4.0p17 and 2.3.0p42.
Is there a workaround for CVE-2025-64997?
There are no documented workarounds for CVE-2025-64997, so upgrading is recommended.