PT-2022-16720 · Checkmk · Checkmk

Published 2022-02-21 · Updated 2024-07-23 · CVE-2022-24564

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.0.0p19 and earlier

Description The issue concerns a Cross Site Scripting (XSS) vulnerability. It occurs when creating or editing a user attribute, where the Help Text is subject to HTML injection. This can be triggered when editing a user.

Recommendations For versions 2.0.0p19 and earlier, consider disabling the editing of user attributes until a patch is available to prevent potential HTML injection. Restrict access to the user attribute editing feature to minimize the risk of exploitation. Avoid using the Help Text field in the user attribute editing section until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24564

Affected Products

Checkmk

References · 4

• https://osv.dev/vulnerability/CVE-2022-24564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24564 · Security Note
• https://checkmk.com/werk/13199 · Vendor Advisory
• https://t.me/cibsecurity/37879 · Telegram Post