Riskcovery

CVE-2025-64996

Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output

State
Published
Severity
4.8 Medium
Published
Nov 18, 2025
Updated
Nov 18, 2025
Reserved
Nov 12, 2025

Read the record on cve.org

Description

In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates world-readable and writable files, allowing any local user on the system to read the plugin's output and manipulate it, potentially leading to unauthorized access to or modification of monitoring data.

Scores

CVSSScoreVectorSource
4.04.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:NCheckmk

Weaknesses

  • CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

ProductVersions
CheckmkCheckmk GmbH
  • 2.4.0 to before 2.4.0p16Affected
  • 2.3.0 to before 2.3.0p41Affected
  • 2.2.0Affected
  • 2.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.