Checkmk

Excluded Methods

Out of Scope

Self-XSS that cannot be exploited against other users, (Distributed) Denial of service attacks against the in-scope domains, machines running Checkmk, or the Checkmk appliances, Lack of HSTS enforcement for Checkmk web applications, Missing cookie flags without a PoC on how this can be exploited, Missing security headers without a PoC on how this can be exploited, HTTP request smuggling without any proven business impact, Blind SSRF without proven business impact (DNS pingback only is not sufficient), HTTP Host header manipulation without a proven business impact, Disclosed and/or misconfigured API keys without proven business impact, Verbose error and log messages that do not reveal personal data or secrets, Clickjacking attacks with low or no impact, Version disclosure without a PoC on how it can be exploited, Open ports without a PoC on how it can be exploited, Weak SSL configurations and SSL/TLS scan reports, Arbitrary file upload without proof of the existence of the uploaded file, Best practices violations (password complexity, expiration, re-use) with low or no impact, Installation of malicious software on machines running Checkmk or on the Checkmk appliances, Physical attacks against the Checkmk appliances, Social engineering attacks against Checkmk employees, partners, or customers, Anything related to email spoofing, SPF, DMARC or DKIM, Email bombing, Side-channel attacks