CVE-2024-13723

Name	CVE-2024-13723
Description	The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4149-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nagvis (PTS)	bullseye	1:1.9.25-2	vulnerable
	bullseye (security)	1:1.9.25-2+deb11u2	fixed
	bookworm	1:1.9.34-1	vulnerable
	forky, sid, trixie	1:1.9.47-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
check-mk	source	(unstable)	(unfixed)
nagvis	source	bullseye	1:1.9.25-2+deb11u1	DLA-4149-1
nagvis	source	(unstable)	1:1.9.42-1

[bookworm] - nagvis <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2025/02/04/4