CVE-2024-1742

LOW

Published Mar 22, 2024 Modified Dec 4, 2024 CWE-214

Description

Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list.

Is your site exposed to CVE-2024-1742?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.8

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness Type (CWE)

CWE-214 CWE-214

Affected Products

Vendor	Product	Versions
checkmk	checkmk	< 2.0.0
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All
checkmk	checkmk	All

References

Advisories & Patches

https://checkmk.com/werk/16234 https://checkmk.com/werk/16234

Frequently Asked Questions

What is CVE-2024-1742? +

How severe is CVE-2024-1742? +

CVE-2024-1742 has a CVSS v3.1 score of 3.8 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-1742? +

CVE-2024-1742 affects products from checkmk, specifically: checkmk. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1742? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-12250 7.9

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation. …

CVE-2020-36771 7.8

CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local …

CVE-2024-4254 7.1

The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper …

CVE-2025-5452 6.6

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential …

CVE-2025-1333 6.0

IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 …

CVE-2025-32987 6.0

Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line …