CVE-2023-2020: Unauthorized scheduling of downtimes via REST API

Description

Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.

Scores

CVSS scores of CVE-2023-2020, by who scored it
Scored by	CVSS	Score	Vector
Tribe29CNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS (exploitation in 30 days): 0.40% · top 65% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

CWE-280: Improper Handling of Insufficient Permissions or Privileges (opens in a new tab)All about CWE-280 and its CVEs
CWE-863 (opens in a new tab)All about CWE-863 and its CVEs

Affected products

Tribe29 · Checkmk
- affected 2.2.0 – ≤ 2.2.0b4
- affected 2.1.0 – ≤ 2.1.0p27

References (1)

https://checkmk.com/werk/13981 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-2020](https://trackcve.app/badge/CVE-2023-2020.svg)](https://trackcve.app/cve/CVE-2023-2020)

Record last updated 5 Feb 2025, 15:48 UTC.