Checkmk URL Validation Bypass Vulnerability Leading to Cross-Site Scripting

A cross-site scripting (XSS) vulnerability has been identified in Checkmk versions 2.5.0 prior to 2.5.0p5, 2.4.0 prior to 2.4.0p31, 2.3.0 prior to 2.3.0p48, and all 2.2.0 versions. The issue arises from improper handling of HTML-encoded characters in the URL validation function, allowing authenticated users to bypass URL validation and inject malicious URLs, such as 'javascript:' URIs. This injection can lead to XSS when another user interacts with the crafted link.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.