Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files.
Weakness
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Checkmk_appliance_firmware | Tribe29 | * | 1.6.8 (excluding) |
| Check-mk | Ubuntu | bionic | * |
| Check-mk | Ubuntu | trusty | * |
| Check-mk | Ubuntu | xenial | * |