CVE-2023-31209

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-74

Affected software

Vendor	Product	Versions
Checkmk GmbH	Checkmk	>= 2.2.0, < 2.2.0p4; >= 2.1.0, < 2.1.0p32; >= 2.0.0, < 2.0.0p38

References

https://checkmk.com/werk/15194Vendor Advisory
https://checkmk.com/werk/15194Vendor Advisory

Timeline

Published: Aug 10, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-31214.6A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects un CVE-2023-312107.8Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights v CVE-2023-312116.5Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials CVE-2023-312129.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7,CVE-2023-312135.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions.CVE-2023-312145.4Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Securi CVE-2023-312158.8Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dr CVE-2023-312168.8Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.CVE-2023-312175.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.CVE-2023-312186.1Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Edito CVE-2023-312194.9Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.CVE-2023-31226.1The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9