CVE-2024-28826

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-73 CWE-610

Affected software

Vendor	Product	Versions
Checkmk GmbH	Checkmk	>= 2.3.0, < 2.3.0p4; >= 2.2.0, < 2.2.0p27; >= 2.1.0, < 2.1.0p44; >= 2.0.0, <= 2.0.0p39
checkmk	checkmk	>= 2.0.0, < 2.0.0p39
checkmk	checkmk	>= 2.1.0, < 2.1.0p44
checkmk	checkmk	>= 2.2.0, < 2.2.0p27
checkmk	checkmk	>= 2.3.0, < 2.3.0p4

References

https://checkmk.com/werk/15200Vendor Advisory
https://checkmk.com/werk/15200Vendor Advisory

Timeline

Published: May 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-288277.8Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allo CVE-2024-288288.8Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site.CVE-2024-288297.8Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p CVE-2024-28838.8Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2024-288302.7Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) caus CVE-2024-288315.4Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by CVE-2024-288324.8Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to CVE-2024-288337.5Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates b CVE-2024-288345.3A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS,CVE-2024-288355.0A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle usi CVE-2024-288365.4An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 CVE-2024-28846.5Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory acce