CVE-2022-48320 - CSRF in add-visual endpoint · CoreCVE

Back Back to CVE browser

MEDIUM

CSRF in add-visual endpoint

Published Feb 20, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.

Affected products

Vendor Tribe29 Product Checkmk Default
unaffected
- Version
  1.6.0
  Status
  affected
  Constraints
  <=1.6.0p30
- Version
  2.0.0
  Status
  affected
  Constraints
  <=2.0.0p31
- Version
  2.1.0
  Status
  affected
  Constraints
  <=2.1.0p17

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
1.6.0	affected	<=1.6.0p30
2.0.0	affected	<=2.0.0p31
2.1.0	affected	<=2.1.0p17

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://checkmk.com/werk/14924
MitigationVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51020
Advisory

Link	Providers	Tags
https://checkmk.com/werk/14924		MitigationVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51020		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Checkmk

Published Feb 20, 2023

Updated Mar 12, 2025

Reserved Feb 8, 2023

Link CVE-2022-48320

CISA Vulnrichment

Updated Mar 12, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-48320

Severity n/a

Public date n/a

Links CVE-2022-48320

Assigner Tribe29

Published Feb 20, 2023

Updated Mar 12, 2025

Exploited since n/a

Link EUVD-2022-51020

EUVD-2022-51020