Lucene search

CheckmkCVELIST:CVE-2024-38858

HistorySep 02, 2024 - 9:16 a.m.

CVE-2024-38858 Cross-site scripting in Robotmk logs view

2024-09-0209:16:40

CWE-79

Checkmk

www.cve.org

cross-site scripting

robotmk

checkmk 2.3.0p14

injection

malicious scripts

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/SC:L/VI:N/SI:L/VA:N/SA:N

EPSS

0.001

Percentile

17.7%

JSON

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Checkmk",
    "vendor": "Checkmk GmbH",
    "versions": [
      {
        "lessThan": "2.3.0p14",
        "status": "affected",
        "version": "2.3.0",
        "versionType": "semver"
      }
    ]
  }
]

References

checkmk.com/werk/17232