CVE-2022-46303

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-463048.8ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated r CVE-2022-463056.5ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass CVE-2022-463067.8ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path CVE-2022-463078.8SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege c CVE-2022-463088.8SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privil CVE-2022-463096.5Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability CVE-2022-46316.1A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The CVE-2022-463107.5The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confident CVE-2022-463117.5The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integrit CVE-2022-463127.5The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexp CVE-2022-463135.3The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of the CVE-2022-463147.5The IPC module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.