by Kastro
Paper/Archive/CVE-2024-8606

CVE-2024-8606

Checkmk GmbH Checkmk — Fix 2FA bypass via RestAPI

EPSS 0.5%CVSS 9.2
critical.is priorityof 100
36
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 39.8.398 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication

Affected

ProductAffectedFixed inSource
Checkmk2.3.0 – < 2.3.0p162.3.0p16CNA
Checkmk2.2.0 – < 2.2.0p342.2.0p34CNA
checkmk2.3.0 – < 2.3.0p162.3.0p16CISA-ADP
checkmk2.2.0 – < 2.2.0p342.2.0p34CISA-ADP

Scores by source

Checkmk (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcheckmk.com/werk/16218