This vulnerability in Checkmk involves insufficient sanitization of the service description value on the prediction graph page, enabling authenticated users to perform Livestatus injection by crafting the service name parameter. The affected versions are prior to 2.5.0b4, 2.4.0p26, and 2.3.0p47. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and limited privileges required. The vulnerability is categorized under CWE-140, which concerns improper neutralization of delimiters leading to injection issues. No patch or official remediation level is provided in the available data.

An authenticated user can inject arbitrary Livestatus commands, potentially manipulating monitoring data or system behavior through the prediction graph page. The impact is limited by the need for authentication and the low complexity of the attack. There are no reports of exploitation in the wild. The vulnerability could affect the integrity and reliability of monitoring data within Checkmk environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted personnel only and monitor for unusual activity related to the prediction graph page. Avoid exposing the affected versions to untrusted users. Follow vendor communications for updates on patches or official mitigations.