CVE-2022-46836

CVE-2022-46836 describes a PHP code injection vulnerability in Tribe29's Checkmk versions 2.1.0p10 and earlier, 2.0.0p27 and earlier, and 1.6.0p29 and earlier, specifically within the watolib auth.php and hosttags.php files. This flaw allows an authenticated attacker to inject and execute arbitrary PHP code remotely. With a CVSS score of 8.8 (High), the vulnerability presents a significant risk, enabling complete compromise of confidentiality, integrity, and availability with low attack complexity. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the CVE has garnered substantial community discussion, indicating awareness and potential interest from researchers or threat actors.