Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files.
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Checkmk_appliance_firmware | Tribe29 | * | 1.6.8 (excluding) |
| Check-mk | Ubuntu | bionic | * |
| Check-mk | Ubuntu | trusty | * |
| Check-mk | Ubuntu | xenial | * |