Opsview · Opsview · CVE-2015-4420
**Name of the Vulnerable Software and Affected Versions**
Opsview versions 4.6.2 and earlier
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML via a crafted check plugin, the description in a host profile, or the `plugin args` parameter to a Test service check page.
**Recommendations**
For Opsview versions 4.6.2 and earlier, as a temporary workaround, consider restricting access to the Test service check page and avoid using the `plugin args` parameter until a fix is available. Additionally, limit the ability to create or modify check plugins and host profiles to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.