Description (CNA)
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Checkmk GmbH / Checkmk | affected 2.2.0; affected 2.3.0 before 2.3.0p46; affected 2.4.0 before 2.4.0p25; affected 2.5.0b1 before 2.5.0 |
CWE
CWE-79
References
- https://checkmk.com/werk/19033
- https://checkmk.com/werk/19583
- https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title
ADP enrichment
No English description supplied.
No references supplied.