Checkmk Sensitive Data Exposure Vulnerability in URL Query Parameters

A vulnerability in Checkmk versions prior to 2.4.0p13, prior to 2.3.0p38, prior to 2.2.0p46, and 2.1.0 (EOL) may lead to the unintentional inclusion of sensitive form data, such as passwords, in URL query parameters. This information could be logged in various locations, including web server logs and browser history. The issue arises when users navigate pages after encountering validation errors, potentially exposing recently entered secrets without affecting stored data.

Impact

Exploitation of this vulnerability could result in the leakage of sensitive information, such as passwords, into URL query parameters, which may be recorded in web server logs or browser history.

Remediation

Users can upgrade to Checkmk versions 2.4.0p13, 2.3.0p38, or 2.2.0p46 to address this vulnerability. Instructions for downloading the latest version can be found on the Checkmk website.