CVE-2025-39663 — Cross Site Scripting through compromised remote site

Description (CNA)

Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).

Affected (CNA)

Vendor / product	Versions
Checkmk GmbH / Checkmk	affected 2.4.0 before 2.4.0p14; affected 2.3.0 before 2.3.0p39; affected 2.2.0; affected 2.1.0

CWE

CWE-80

References

https://checkmk.com/werk/17998
https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Nov/0