CVE-2023-22359 : User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumer

User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.

Published 2023-06-26 07:15:09

Updated 2024-08-26 10:15:04

Source Checkmk GmbH

View at NVD, CVE.org

Products affected by CVE-2023-22359

Checkmk » Checkmk » Version: 2.2.0 Update I1
cpe:2.3:a:checkmk:checkmk:2.2.0:i1:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0
cpe:2.3:a:checkmk:checkmk:2.2.0:-:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B1
cpe:2.3:a:checkmk:checkmk:2.2.0:b1:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B2
cpe:2.3:a:checkmk:checkmk:2.2.0:b2:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B3
cpe:2.3:a:checkmk:checkmk:2.2.0:b3:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B4
cpe:2.3:a:checkmk:checkmk:2.2.0:b4:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B5
cpe:2.3:a:checkmk:checkmk:2.2.0:b5:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B6
cpe:2.3:a:checkmk:checkmk:2.2.0:b6:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B7
cpe:2.3:a:checkmk:checkmk:2.2.0:b7:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update B8
cpe:2.3:a:checkmk:checkmk:2.2.0:b8:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update P1
cpe:2.3:a:checkmk:checkmk:2.2.0:p1:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update P2
cpe:2.3:a:checkmk:checkmk:2.2.0:p2:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update P3
cpe:2.3:a:checkmk:checkmk:2.2.0:p3:*:*:*:*:*:*
Matching versions
Checkmk » Checkmk » Version: 2.2.0 Update P4
cpe:2.3:a:checkmk:checkmk:2.2.0:p4:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-22359

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-22359

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	Checkmk GmbH
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-22359

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security@checkmk.com (Secondary)
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Assigned by: security@checkmk.com (Secondary)

References for CVE-2023-22359

https://checkmk.com/werk/15890

user: read permissions are now checked in the request schema before delete/edit/create user
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-22359

Products affected by CVE-2023-22359

Exploit prediction scoring system (EPSS) score for CVE-2023-22359

CVSS scores for CVE-2023-22359

CWE ids for CVE-2023-22359

References for CVE-2023-22359