Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://checkmk.com/werk/17495 cve-icon cve-icon
History

Wed, 19 Feb 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Feb 2025 10:00:00 +0000

Type Values Removed Values Added
Description Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.
Title LDAP credentials logged to Apache error log
Weaknesses CWE-532
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Checkmk

Published: 2025-02-19T09:49:55.695Z

Updated: 2025-02-19T14:36:47.160Z

Reserved: 2025-02-06T09:27:06.794Z

Link: CVE-2025-1075

cve-icon Vulnrichment

Updated: 2025-02-19T14:36:41.808Z

cve-icon NVD

Status : Received

Published: 2025-02-19T10:15:09.043

Modified: 2025-02-19T10:15:09.043

Link: CVE-2025-1075

cve-icon Redhat

No data.