Missing Authorization in Checkmk Allows Job Status Access

Executive Summary

This vulnerability is a missing authorization check in Checkmk versions below 2.5.0p12, 2.4.0p36, and 2.3.0p50, as well as all 2.2.0 versions. An authenticated user who knows a background job's ID can view that job's status and results without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized access to background job results in Checkmk logs. Look for requests to job status endpoints with known job IDs. Review user activity logs for unusual access patterns to job data.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could view sensitive job details, such as autodiscovery results, potentially exposing system information. While no sensitive data was confirmed during testing, the risk depends on job types and ID predictability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability could potentially expose job status and results to unauthorized authenticated users, which may include sensitive data depending on the job type. This could lead to non-compliance with GDPR if personal data is exposed or HIPAA if health-related data is involved, as unauthorized access violates data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Checkmk to versions 2.5.0p12, 2.4.0p36, or 2.3.0p50 or later. If using 2.2.0, migrate to a supported version immediately. Ensure all background job IDs are unpredictable to prevent exploitation.

Useful 0 Not Useful 0