Checkmk Sensitive Information Logging Vulnerability in LDAP Integration

A vulnerability exists in Checkmk versions prior to 2.3.0p27, prior to 2.2.0p40, and 2.1.0p51 (EOL), where LDAP credentials are logged to the Apache error log. This occurs when the 'LDAP' log level is set to 'Debug' and an LDAP integration is active. The logged information, including usernames and passwords, is accessible to administrators.

Impact

Exploitation of this vulnerability leads to the unintentional exposure of LDAP credentials, including usernames and passwords, in the Apache error log file.

Remediation

Users can update to Checkmk versions 2.3.0p27, 2.2.0p40, or 2.5.0b1. If unable to update, the 'LDAP' log level can be changed to any value other than 'Debug' to prevent password logging.