CVE-2022-46302

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-463037.5Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with CVE-2022-463048.8ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated r CVE-2022-463056.5ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass CVE-2022-463067.8ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path CVE-2022-463078.8SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege c CVE-2022-463088.8SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privil CVE-2022-463096.5Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability CVE-2022-46316.1A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The CVE-2022-463107.5The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confident CVE-2022-463117.5The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integrit CVE-2022-463127.5The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexp CVE-2022-463135.3The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of the