CVE-2023-0284

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Tribe29	Checkmk	>= 2.0.0, <= 2.0.0p32; >= 2.1.0, <= 2.1.0p19; >= 1.6.0, <= 1.6.0p30

References

https://checkmk.com/werk/15181Vendor Advisory
https://checkmk.com/werk/15181Vendor Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02855.4The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with t CVE-2023-02867.4There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an CVE-2023-02875.4A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality CVE-2023-02887.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.CVE-2023-02895.4Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.CVE-2023-02904.3Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where t CVE-2023-02919.1The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated CVE-2023-02928.1The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is CVE-2023-02934.3The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its A CVE-2023-02944.3The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.CVE-2023-02954.8The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, an CVE-2023-02965.3The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy comp