Checkmk Stored Cross-Site Scripting Vulnerability in Unified Search

A stored cross-site scripting vulnerability has been identified in Checkmk version 2.5.0 (beta) prior to 2.5.0b2. This vulnerability allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users using the Unified Search feature. The issue arises because host and service names were not properly sanitized before being displayed in search results, enabling the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the search results.

Remediation

Users can upgrade to Checkmk version 2.5.0b2 or 2.6.0b1 to address this vulnerability.