Vulnerability · Published Feb 20, 2023 · Assigned by Tribe29
CVE-2022-46303Command injection in SMS notifications
High 8.0
In plain English
A high-severity improper input validation in Checkmk from Tribe29. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)1.1%top 34.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions.
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H