Checkmk Cross-Site Scripting Vulnerability in Synthetic Monitoring Logs

A cross-site scripting (XSS) vulnerability has been identified in Checkmk versions 2.4.0 prior to 2.4.0p22, and 2.3.0 prior to 2.3.0p43. This vulnerability allows an attacker who can manipulate a host's check output to inject malicious JavaScript into the Synthetic Monitoring HTML logs. The injected script can be accessed through a crafted phishing link, exploiting the way Checkmk renders these logs in the user interface.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update to Checkmk versions 2.4.0p22 or 2.3.0p43. Phishing links that could exploit this vulnerability should not be clicked.