CVE-2022-46302 - CVE House
Back to Database
Status published High CVE-2022-46302

Remote Code Execution with Root Privileges via Broad Apache Permissions

Vulnerability Description

Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-46302

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Jan-Philipp Litza (PLUTEX GmbH)

References

More from Tribe29

View All →
CVE-2023-31207
Automation user secret logged to Apache access log
Medium 4.4
CVE-2023-2020
Unauthorized scheduling of downtimes via REST API
Medium 4.3
CVE-2023-22359
User-enumeration in RestAPI
Medium 4.3
CVE-2023-22318
Denial of service against webconf
High 7.5
CVE-2023-22309
Reflected Cross Site Scripting (XSS)
Medium 6.1

Affected Vendor

Affected Software

Checkmk
Vulnerable Versions:
2.0.0, 2.1.0, 1.6.0

Timeline

Official Publish: April 20th, 2023
Last Modified: February 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-829

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.