CVE-2023-22318 : Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.

Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.

Published 2023-05-15 09:15:10

Updated 2023-05-25 20:35:24

Source Checkmk GmbH

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-22318

Tribe29 » Checkmk Appliance Firmware
Versions before (<) 1.6.5
cpe:2.3:o:tribe29:checkmk_appliance_firmware:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Checkmk GmbH
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-412 Unrestricted Externally Accessible Lock

The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

Assigned by: security@checkmk.com (Secondary)
CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Assigned by: nvd@nist.gov (Primary)

https://checkmk.com/werk/9526

Fix denial of service against webconf
Mitigation;Vendor Advisory

Jump to