Arbitrary Script Execution via SLA Column Title Injection in Previous Checkmk Versions
CVE-2024-38859

6.1MEDIUM

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
26 August 2024

What is CVE-2024-38859?

XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by other users.

Affected Version(s)

Checkmk 2.3.0 < 2.3.0p14

Checkmk 2.2.0 < 2.2.0p33

Checkmk 2.1.0 < 2.1.0p47

References

https://checkmk.com/werk/17026

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.