Snapshot 4082
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Vulnerability Disclosure Policy At Checkmk we are committed to delivering software and hardware that offer the best quality to our users and customers. The security team at Checkmk contributes to this objective by striving to ensure the security of our products, both, during their development and after their release. To that end, we are continuously scanning and testing our software and hardware to identify potential vulnerabilities and to mitigate them as soon as possible. In addition to our efforts, we rely on external sources to help us identify vulnerabilities in our products. Hence, we encourage everyone, including security researchers, customers, partners, Computer Emergency Response Teams (CERT) groups, and any other source, to report identified vulnerabilities. Furthermore, we respect the will of reporting parties to maintain their anonymity and welcome anonymous submissions. In return, we strongly encourage coordinated disclosure of vulnerabilities and kindly ask the reporting parties to maintain the confidentiality of found vulnerabilities until they have been fixed. We aspire to address reported vulnerabilities within a period of 90 days. Reporting Process If you identify a vulnerability in one of our assets (listed in the Scope section below), please send your findings in English or German via email to security@checkmk.com. For each of the submitted finding(s) you should include the following information: Description of the identified vulnerability, including: The type of vulnerability The vulnerable component(s) An example of how an attacker can exploit this vulnerability Proof-of-concept exploit that leverages the identified vulnerability. Video demonstrations in the form of screencasts are also accepted. We would like to give credit to the reporting parties. If you want your name/email/social media handle to be associated with the finding(s), please let us know. The more details you include in your report, the easier and swifter for our security team to triage and verify the existence of the vulnerability. In addition to that, please honor to the following guidelines: Avoid violating the privacy of others, disrupting our systems, or destroying data Do not hold back any vulnerabilities you identified Redact any sensitive information you would prefer is not stored by Checkmk before submitting your report Stick to the scope outlined below Do not engage in extortion After submission, the Checkmk security team will contact you within a few business days. In their response the team will either acknowledge the vulnerability or ask for further details on how to reproduce the vulnerability. Checkmk’s Promise We appreciate your submissions and your willingness to help Checkmk develop and maintain high-quality, secure software. Following this Vulnerability Disclosure Policy, we assure you to make our best effort to: Respond to your submissions as quickly as we can, ideally within a few days Contact you with further questions about the submitted finding, if we could not reproduce it Recognize your effort in accordance with our current company policies and your willingness to be mentioned Not pursue any claims against reporting parties provided that: The reporting parties do not cause deliberate harm to Checkmk, its partners, or its customers The reporting parties do not violate the privacy or safety of Checkmk, its partners, or its customers The reporting parties do not violate criminal law Potentially offer a token of appreciation, depending on: The quality of the report The assessed criticality of the report Scope The following section breaks down what aspects of the Checkmk public sphere are considered in scope as well as what type of attacks or products are considered to be out of scope. In Scope The following assets are in scope of the Vulnerability Disclosure Program: The Checkmk codebase. The Checkmk K8s cluster collector The Checkmk Grafana datasource The Checkmk appliance The Checkmk website and its subdomains: checkmk.com tribe29.com Out of Scope The following attacks are not in the scope of this vulnerability disclosure program: Self-XSS that cannot be exploited against other users (Distributed) Denial of service (DDoS) attacks against the aforementioned domains, machines running Checkmk, or the Checkmk appliances Lack of HSTS enforcement for Checkmk web applications Missing Cookie flags without a PoC on how this can be exploited Missing security headers without a PoC on how this can be exploited HTTP Request smuggling without any proven business impact Blind SSRF without proven business impact (DNS pingback only is not sufficient) HTTP Host headers manipulation without a proven business impact Disclosed and/or misconfigured API keys without proven business impact Verbose error and log messages that do not reveal personal data or secrets Clickjacking attacks with low or no impact Version disclosure without PoC on how it can be exploited Open ports without PoC on how it can be exploited Weak SSL configurations and SSL/TLS scan reports Arbitrary file upload without proof of the existence of the uploaded file Best practices violations (password complexity, expiration, re-use, etc.), with low or no impact Installation of malicious software on machines running Checkmk or on the Checkmk appliances Physical attacks against the Checkmk appliances Social engineering attacks against Checkmk’s employees, partners, or customers (e.g., phishing, vishing, waterholing, typosquatting, homograph attacks, etc.) Anything related to email spoofing, SPF, DMARC or DKIM Email bombing Side-channel attacks Policy Version The current version of this policy is v2.2.0 and was last updated on 2025-05-26 Try out Checkmk now. Download Checkmk Free and open source monitoring Play with Checkmk Try Checkmk without installing