CVE-2024-0670

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Checkmk GmbH	Checkmk	>= 2.2.0, < 2.2.0p23; >= 2.1.0, < 2.1.0p40; >= 2.0.0, <= 2.0.0p39
checkmk	checkmk	>= 2.2.0, < 2.2.0p23; >= 2.1.0, < 2.1.0p40; >= 2.0.0, < 2.0.0p39

References

http://seclists.org/fulldisclosure/2024/Mar/29Mailing List
https://checkmk.com/werk/16361Vendor Advisory
http://seclists.org/fulldisclosure/2024/Mar/29Mailing List
https://checkmk.com/werk/16361Vendor Advisory

Timeline

Published: Mar 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-06716.8Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm CVE-2024-06727.1The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a CVE-2024-06736.1The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2024-06747.8Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root CVE-2024-06756.8Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the e CVE-2024-06767.1Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact CVE-2024-06775.1The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a CVE-2024-06786.1The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' para CVE-2024-06796.5The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() func CVE-2024-06805.3The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is CVE-2024-06815.3The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up CVE-2024-06825.3The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to t