6.1

CVE-2024-38858

Cross-site scripting in Robotmk logs view

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Checkmk ≫ Checkmk Version < 2.3.0
Checkmk ≫ Checkmk Version 2.3.0 Update -
Checkmk ≫ Checkmk Version 2.3.0 Update p1
Checkmk ≫ Checkmk Version 2.3.0 Update p10
Checkmk ≫ Checkmk Version 2.3.0 Update p11
Checkmk ≫ Checkmk Version 2.3.0 Update p12
Checkmk ≫ Checkmk Version 2.3.0 Update p13
Checkmk ≫ Checkmk Version 2.3.0 Update p2
Checkmk ≫ Checkmk Version 2.3.0 Update p3
Checkmk ≫ Checkmk Version 2.3.0 Update p4
Checkmk ≫ Checkmk Version 2.3.0 Update p5
Checkmk ≫ Checkmk Version 2.3.0 Update p6
Checkmk ≫ Checkmk Version 2.3.0 Update p7
Checkmk ≫ Checkmk Version 2.3.0 Update p8
Checkmk ≫ Checkmk Version 2.3.0 Update p9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.253
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security@checkmk.com 2.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://checkmk.com/werk/17232
Vendor Advisory