6.1

CVE-2024-38858

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Checkmk ≫ Checkmk Version < 2.3.0
Checkmk ≫ Checkmk Version2.3.0 Update-
Checkmk ≫ Checkmk Version2.3.0 Updatep1
Checkmk ≫ Checkmk Version2.3.0 Updatep10
Checkmk ≫ Checkmk Version2.3.0 Updatep11
Checkmk ≫ Checkmk Version2.3.0 Updatep12
Checkmk ≫ Checkmk Version2.3.0 Updatep13
Checkmk ≫ Checkmk Version2.3.0 Updatep2
Checkmk ≫ Checkmk Version2.3.0 Updatep3
Checkmk ≫ Checkmk Version2.3.0 Updatep4
Checkmk ≫ Checkmk Version2.3.0 Updatep5
Checkmk ≫ Checkmk Version2.3.0 Updatep6
Checkmk ≫ Checkmk Version2.3.0 Updatep7
Checkmk ≫ Checkmk Version2.3.0 Updatep8
Checkmk ≫ Checkmk Version2.3.0 Updatep9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.23% 0.787
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security@checkmk.com 2.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.