Checkmk Stored Cross-Site Scripting Vulnerability in Service Discovery Active Check Output

A stored cross-site scripting vulnerability has been identified in Checkmk versions 2.5.0 prior to 2.5.0p5, 2.4.0 prior to 2.4.0p31, 2.3.0 prior to 2.3.0p48, and all 2.2.0 versions. This vulnerability allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into the check output. The injected script executes in the browser of an admin or a user with host read permissions when the check is run on the service discovery page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the check output.

Remediation

Users can upgrade to Checkmk versions 2.5.0p5, 2.4.0p31, or 2.3.0p48 to address this vulnerability. Instructions for downloading the latest version can be found on the Checkmk website.