{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": [
              "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:-:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p1:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p10:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p11:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p12:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p13:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p14:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p15:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p16:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p2:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p3:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p4:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p5:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p6:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p7:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p8:*:*:*:*:*:*",
              "cpe:2.3:a:checkmk:checkmk:1.6.0:p9:*:*:*:*:*:*"
            ],
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.6.0"
              },
              {
                "introduced": "1.6.0-NA"
              },
              {
                "last_affected": "1.6.0-NA"
              },
              {
                "introduced": "1.6.0-p1"
              },
              {
                "last_affected": "1.6.0-p1"
              },
              {
                "introduced": "1.6.0-p10"
              },
              {
                "last_affected": "1.6.0-p10"
              },
              {
                "introduced": "1.6.0-p11"
              },
              {
                "last_affected": "1.6.0-p11"
              },
              {
                "introduced": "1.6.0-p12"
              },
              {
                "last_affected": "1.6.0-p12"
              },
              {
                "introduced": "1.6.0-p13"
              },
              {
                "last_affected": "1.6.0-p13"
              },
              {
                "introduced": "1.6.0-p14"
              },
              {
                "last_affected": "1.6.0-p14"
              },
              {
                "introduced": "1.6.0-p15"
              },
              {
                "last_affected": "1.6.0-p15"
              },
              {
                "introduced": "1.6.0-p16"
              },
              {
                "last_affected": "1.6.0-p16"
              },
              {
                "introduced": "1.6.0-p2"
              },
              {
                "last_affected": "1.6.0-p2"
              },
              {
                "introduced": "1.6.0-p3"
              },
              {
                "last_affected": "1.6.0-p3"
              },
              {
                "introduced": "1.6.0-p4"
              },
              {
                "last_affected": "1.6.0-p4"
              },
              {
                "introduced": "1.6.0-p5"
              },
              {
                "last_affected": "1.6.0-p5"
              },
              {
                "introduced": "1.6.0-p6"
              },
              {
                "last_affected": "1.6.0-p6"
              },
              {
                "introduced": "1.6.0-p7"
              },
              {
                "last_affected": "1.6.0-p7"
              },
              {
                "introduced": "1.6.0-p8"
              },
              {
                "last_affected": "1.6.0-p8"
              },
              {
                "introduced": "1.6.0-p9"
              },
              {
                "last_affected": "1.6.0-p9"
              }
            ],
            "source": [
              "CPE_RANGE",
              "CPE_STRING"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "d5ccd5ecc956e665aca80f3c486f7fa46f409424"
            },
            {
              "introduced": "d5ccd5ecc956e665aca80f3c486f7fa46f409424"
            },
            {
              "last_affected": "2c7990e82af4fff30379472838eb5b9ef0ebfa7a"
            }
          ],
          "repo": "https://github.com/checkmk/checkmk",
          "type": "GIT"
        }
      ],
      "versions": [
        "1.6.0-NA",
        "1.6.0-p1",
        "1.6.0-p10",
        "1.6.0-p11",
        "1.6.0-p12",
        "1.6.0-p13",
        "1.6.0-p14",
        "1.6.0-p15",
        "1.6.0-p16",
        "1.6.0-p2",
        "1.6.0-p3",
        "1.6.0-p4",
        "1.6.0-p5",
        "1.6.0-p6",
        "1.6.0-p7",
        "1.6.0-p8",
        "1.6.0-p9"
      ]
    }
  ],
  "database_specific": {},
  "details": "Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\\checkmk\\agent\\local directory.",
  "id": "CVE-2020-24908",
  "modified": "2026-07-08T05:36:53.798365431Z",
  "published": "2021-02-19T06:15:12.510Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://compass-security.com/fileadmin/Research/Advisories/2020-05_CSNC-2020-005_Checkmk_Local_Privilege_Escalation.txt"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}