Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2024-38859

UNKNOWN
Published 2024-08-26T14:15:32.555Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2024-38859. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by other users.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Checkmk GmbH

Checkmk

Affected Versions:

2.3.0 2.2.0 2.1.0 2.0.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed MODERATE

GHSA-5554-3cr8-7rwc

Advisory Details

XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by other users.

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-38859
WEB https://checkmk.com/werk/17026

Advisory provided by GitHub Security Advisory Database. Published: August 26, 2024, Modified: December 3, 2024

References

https://checkmk.com/werk/17026
Published: 2024-08-26T14:15:32.555Z
Last Modified: 2024-08-26T15:22:30.830Z
Copied to clipboard!