Privilege escalation in agent via LD_LIBRARY_PATH
Priority MEDIUM 41CWE-427Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00536 45th percentileScored 2026-11-07
Fix Fixed Checkmk (Checkmk GmbH): 2.2.0p17
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.2.0p10 to before 2.2.0p17 | 2.2.0p17 | Patch available | CNA |
- Checkmk VendorCheckmk GmbH Affected 2.2.0p10 to before 2.2.0p17 Fixed in 2.2.0p17 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:* | 2.2.0 p10 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:* | 2.2.0 p11 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:* | 2.2.0 p12 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:* | 2.2.0 p13 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:* | 2.2.0 p14 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.2.0:p15:*:*:*:*:*:* | 2.2.0 p15 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:* | 2.2.0 p16 | Vulnerable | Checkmk GmbH |
- cpe:2.3:a:checkmk:checkmk:2.2.0:p10:*:*:*:*:*:* Versions 2.2.0 p10 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.2.0:p11:*:*:*:*:*:* Versions 2.2.0 p11 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.2.0:p12:*:*:*:*:*:* Versions 2.2.0 p12 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.2.0:p13:*:*:*:*:*:* Versions 2.2.0 p13 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.2.0:p14:*:*:*:*:*:* Versions 2.2.0 p14 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.2.0:p15:*:*:*:*:*:* Versions 2.2.0 p15 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.2.0:p16:*:*:*:*:*:* Versions 2.2.0 p16 Vulnerable ·Checkmk GmbH
Remediation
- Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.2.0p17
Timeline
- 2026-10-02 Threatist record created from CVE-2023-31210
- 2026-10-03 Alias added: GHSA-45w9-c3q7-mccg
References
Advisory 1
More Checkmk GmbH Checkmk vulnerabilities
- TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
- TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
- TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
- TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8
- TI-2021-17818 The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does… CVSS 3.1HIGH 8.8
- TI-2021-17817 The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a… CVSS 3.1HIGH 8.8
Sources
- CVE-2023-31210 · CVE Program
- CVE-2023-31210 · NVD
- FIRST EPSS
- GHSA-45w9-c3q7-mccg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences