Skip to content
OpenAdvisories
Medium WID-SEC-2024-1414 2 CVEs

Checkmk: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Jun 19, 2024 · Updated Jun 19, 2024 · de-DE

Vendor: Checkmk Product: Checkmk

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Checkmk ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Checkmk ist eine IT-Monitoring-Software.

Vulnerabilities 2

  • Medium 5.4
    CVE-2024-28831

    XSS in confirmation pop-up

    Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up.

    Checkmk Checkmk check-mk Ubuntu
  • Medium 4.8
    CVE-2024-28832

    XSS in Crash Report Page

    Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Settings to execute arbitrary scripts by injecting HTML elements into the Crash Report URL in the Global …

    Checkmk Checkmk check-mk Ubuntu

Revision history

  1. #1

    Initiale Fassung

References