CVE-2024-38863

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-38863
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38863.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38863
Downstream
Published
2024-10-14T08:15:02.823Z
Modified
2025-11-20T13:40:55.315080Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.

References

Affected packages

Git / github.com/checkmk/checkmk

Affected ranges

Type
GIT
Repo
https://github.com/checkmk/checkmk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
04c27ac750cc5a20ed931e7d920cb007897b7d3c
Last affected
07125838894d877a8f3c6110dc28ec40ba9fff8f
Last affected
090dc111008fa06bb191da268fd50a69336589d2
Last affected
0a8b67d5baf80c5677a2070c0eff2523854e88bc
Last affected
0c39f13b1a2025dd8ba4926b1da72a86d3a08661
Last affected
0d2681c53226611c965c0d94ff233e497b5a4317
Last affected
0e046c3b22294ef5ec66b8372ece87becf7d3430
Last affected
158833c70eca216170cdd4b16c2955106f5ce14e
Last affected
1fc0aea14b848c3d4eaf779a42ac59e3af0e8df6
Last affected
22de8967ee57635f022996260036f7059c359d77
Last affected
241e7e776b96d316693575e91023518e20e171be
Last affected
257af35825115a122e4100973d840c041ea3edf5
Last affected
267fa27ce44b36ca91fbd6446837c5713df736fc
Last affected
2a6bc3d8dc8852375275f81654dd00a1f94f5ffd
Last affected
2af920cff2daef0ec57c16ec6ec4c0ab3a98f95f
Last affected
2bc11315273eb7bdbd3ca42f4d726527b204519e
Last affected
30b2599d7a503a4993b801cb233784d545e2ed9a
Last affected
324bd38f5b76f73f236e495af0c9228b65d15528
Last affected
35f34b0cf3e832750898c365d1a492f7b76a4c6e
Last affected
3958c6537b40158aa2ed18975990d680085debf4
Last affected
3b78272d604bfda3f7954ae5cec8ff3e3fddc5cf
Last affected
3ff75be1738cb01a6b51a394d5d4178ee7cd792e
Last affected
418c120db01cb5030ac6d51e2b54b5277e44738b
Last affected
42a52411ba088bdf2c369e5c042fc31a6ee75808
Last affected
4a194cdc9f337ef68e31af63eedf88054f7fddc1
Last affected
4a9f01eaebaa33dd83008b72d3a7f54321d42b73
Last affected
4be57271cbf081c9a1719dc3b1718b43d5e52f4b
Last affected
4cbff4e1a0ac90dc4d91939fc63184a0fcc0c3da
Last affected
4d8844283611a93748e85d55382420d04c48078c
Last affected
4dabbfb583bb1e70b3257a8a3fc7bcdacaf8b4e9
Last affected
4f2a730421ff1fb5c192128e7dfd44b1146c044f
Last affected
50647817f1cdea137dce2d798f7e69d74e54dc5d
Last affected
508755cc7caec8829b6acb83dc8857c10f3c1d9f
Last affected
516811eef93eaf64b271a824d36503197fc53679
Last affected
53176011b9caff834c240a7c5e9da6abacdd14a6
Last affected
5554a04b2c158ae9b0e01ef1b591fe3702ea5ac0
Last affected
5ba483a2e011b281853e3d4789c7f77d5bd2915c
Last affected
5cf0476d6b0cba20b3aafb01b187c63a9fda92bd
Last affected
5e13705010f4fc8edd4fbd6165929c9711af3ec6
Last affected
5f1159fd360b7aa0947da5238b056b59d011bd31
Last affected
5f39f0d82a0232813ad5b53e584aa1188baa5a9a
Last affected
603bd98e26ab35ce5126fee36c84778170869878
Last affected
623dcff78335d93ebf989dc65e15c5b70ada82ce
Last affected
62baa2031dbc7dfc55f4700f98773bc5cf544f48
Last affected
6469d83df4405f4d71a3e3f381d210c406fe5389
Last affected
65236b565e0f57dd058f395704b20154aff30847
Last affected
6a686961c4b760c55a13cfdb61e7c02be832a0be
Last affected
6b3449c7811f109b40ad60b4e23f5b8b25d070f2
Last affected
6c772598aac4018077fadeb0c38b94381cafb27f
Last affected
6d181fbfbfbc98415313b4cb0ad96ded5ddd7abd
Last affected
703ad6132e92a66f555aa100c8dff8220a3613aa
Last affected
72fdb481b2f673c5a80d56cfec3dffa598195a0e
Last affected
774354b2551f8e27948fc4cebfc950ee81d28e0d
Last affected
779a2941a075e1461b45407f715176524414b994
Last affected
83c4e71db331cd43fb0769a52ceb2b5a0188a31b
Last affected
8476719e4cb80a4eb715c99f1347d9ee89ea6e5a
Last affected
89df3c399664ac47711f628042b180222de1580d
Last affected
93590d801961d180c7958a478839a07b2cbb1d77
Last affected
95921f1e4125336395d0bc85434f91c0a0f8f571
Last affected
991ffeda722dc12d049c3dd7a667cb5ef08a8fc7
Last affected
996ca03a86e23025fe7544b47005043ae6be9084
Last affected
99e799274b02e6b29392845173bb5bfccccfcaba
Last affected
9b7289dd5ced8f05ec16651360c1b2db06a9b3a2
Last affected
a486871d926fd65b3b7837372d7e52614ce63e3f
Last affected
a5fbb41e2f4568843e01625799cedbfd753373c6
Last affected
a656430461523e83e2a5e4a0441179c665de48f5
Last affected
a6aaa241192f2257300a50839bf7423b335b7771
Last affected
a889f51a7d8216e1ac9b9db00637ae8179a0dd53
Last affected
b6b3d5d682a04ac1de9f5a7e6aab4bec9529562c
Last affected
b765e39ffb10efc5bf5908857708269530c279b9
Last affected
be4ee84ebb62f6f7a9af75bf026585e6561fafc2
Last affected
becdac05f934c40103587ed74c310e4d207c67cf
Last affected
c025ee83fb7fd0cc7459507759a7a0b888cf2ad4
Last affected
c22eef945099a0f0c8dc48204286389807647cc9
Last affected
c50227b2d31fa221f1e5eab00c31ce2f27f7d345
Last affected
c5a9ed82c6f3115b7aaa46c6aa1b63953d8d5ce5
Last affected
c62ef1ec227148e32aba897ca78936ae8dc6c07e
Last affected
c91ffa81b3cb743d0f8aafb8b18a63e77d971096
Last affected
d2607dde3dd4fcaf3357df418f83060293bed122
Last affected
d2b1a66866b6d320fdae51a0609425ba609530e7
Last affected
d3c7ace5f5f48c54974558e49f4a088735be56a8
Last affected
d4289fb7f58f6387d62713179131946f44a9aa69
Last affected
d6049cd2d82eba3842b30c305912b9e946842463
Last affected
d662d3c2ed0d9784427bae8300941b732ff5d81b
Last affected
d85a2e5143ecba3b73784a9825264d0a576382b1
Last affected
e04f338e4054b32db1de80f3e6cc75c2d65f2df5
Last affected
e5861f0cab1099a17d23657c9ed1054590f5c769
Last affected
e6953e95b912b9fe5a4f3d87a52cad7cc7cc83f8
Last affected
e6f1a771a2ec9750625fbbd0a18495676e039b1c
Last affected
e7c2c6e2d0a37abb15a5af3414640d4d8f5c2432
Last affected
e91b5d2ed6de204446d73736f9d6e9920c8c6ab4
Last affected
eda43696c54223b7b5fdcf3f4c3a44ab841061fe
Last affected
eec5d03b7dbf374bcf1a3ae41ca5a9d6a69f6acb
Last affected
eeeec8ef1920069355120bbb7ee3bd337d5fde0a
Last affected
efae348ad2f79f8f2d22b711502d959e9bb56535
Last affected
f56f395c4845647b1fd0696858c094d26c006f27
Last affected
f6e5b1d363dcf0d89c69ae52d703c1c27a30a20f
Last affected
f93c345b2ef1435d51333d3593a6b1701d5c249c
Last affected
f9da425b482f2e430343b235449ff33114bf4ddc
Last affected
fa86a9c4942ad6905591b3863f777218e9c4df91
Last affected
fd541d4d7d95668dd33d61bc16fa8df17f4affcf

Affected versions

1.*

1.1.0beta17

v1.*

v1.1.0
v1.1.10
v1.1.10b1
v1.1.10b2
v1.1.11i1
v1.1.11i2
v1.1.11i3
v1.1.11i4
v1.1.12
v1.1.12b1
v1.1.12b2
v1.1.13i1
v1.1.13i2
v1.1.13i3
v1.1.2
v1.1.3
v1.1.3b1
v1.1.4
v1.1.5i0
v1.1.5i1
v1.1.5i2
v1.1.5i3
v1.1.6
v1.1.6b2
v1.1.6b3
v1.1.7i1
v1.1.7i2
v1.1.7i3
v1.1.7i4
v1.1.7i5
v1.1.8
v1.1.8b1
v1.1.8b2
v1.1.8b3
v1.1.9i1
v1.1.9i2
v1.1.9i3
v1.1.9i4
v1.1.9i5
v1.1.9i6
v1.1.9i7
v1.1.9i8
v1.1.9i9
v1.2.0b1
v1.2.0b2
v1.2.0b3
v1.2.0b4
v1.2.0b5
v1.2.0b6
v1.2.0p1
v1.2.0p2
v1.2.0p3
v1.2.1i1
v1.2.1i2
v1.2.1i3
v1.2.1i4
v1.2.1i5
v1.2.2b1
v1.2.3i1
v1.2.3i2
v1.2.3i3
v1.2.3i4
v1.2.3i5
v1.2.3i6
v1.2.3i7
v1.2.5i1
v1.2.5i2
v1.2.5i3
v1.2.5i4
v1.2.5i5
v1.2.5i6
v1.2.7i1
v1.2.7i2
v1.2.7i3
v1.4.0i1
v1.4.0i2
v1.4.0i3
v1.5.0i1
v1.5.0i2
v1.5.0i3
v1.6.0b1

v2.*

v2.0.0i1
v2.1.0
v2.1.0b1
v2.1.0b2
v2.1.0b3
v2.1.0b4
v2.1.0b5
v2.1.0b6
v2.1.0b7
v2.1.0b8
v2.1.0b9
v2.1.0p1
v2.1.0p2
v2.1.0p3
v2.1.0p4
v2.1.0p5
v2.2.0
v2.2.0-rc1
v2.2.0b1
v2.2.0b1-rc1
v2.2.0b1-rc2
v2.2.0b2
v2.2.0b2-rc1
v2.2.0b3
v2.2.0b3-rc1
v2.2.0b4
v2.2.0b4-rc1
v2.2.0b5
v2.2.0b5-rc1
v2.2.0b5-rc2
v2.2.0b6
v2.2.0b6-rc1
v2.2.0b7
v2.2.0b7-rc1
v2.2.0b8
v2.2.0b8-rc1
v2.2.0p1
v2.2.0p1-rc1
v2.2.0p2
v2.2.0p2-rc1
v2.2.0p3
v2.2.0p3-rc1
v2.2.0p4
v2.2.0p4-rc1
v2.2.0p4-rc2
v2.2.0p5
v2.2.0p5-rc1
v2.2.0p6
v2.2.0p6-rc1
v2.2.0p6-rc2
v2.2.0p6-rc3
v2.2.0p7
v2.2.0p7-rc1
v2.2.0p8
v2.2.0p8-rc1
v2.2.0p8-rc2
v2.2.0p9
v2.2.0p9-rc1
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.3.0-rc3
v2.3.0b1
v2.3.0b1-rc1
v2.3.0b1-rc2
v2.3.0b2
v2.3.0b2-rc1
v2.3.0b3
v2.3.0b3-rc1
v2.3.0b4-rc1
v2.3.0b4-rc2
v2.3.0b5
v2.3.0b5-rc1
v2.3.0b6-rc1
v2.3.0p1
v2.3.0p1-rc1
v2.3.0p2
v2.3.0p2-rc1
v2.3.0p3-rc1
v2.3.0p4
v2.3.0p4-rc1
v2.3.0p5
v2.3.0p5-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38863.json"