Stored XSS Vulnerability in Checkmk Pop-Ups
CVE-2024-28831

5.4MEDIUM

Key Information:

Vendor
Checkmk Gmbh
Status
Checkmk
Vendor
CVE Published:
25 June 2024

Summary

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up.

Affected Version(s)

Checkmk 2.3.0 < 2.3.0p7

Checkmk 2.2.0 < 2.2.0p28

References

https://checkmk.com/werk/17025

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PS Positive Security GmbH
.