CVE-2014-5338: XSS

Published Aug 22, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the multisite component in CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the (1) renderstatusicons function in htmllib.py or (2) ajaxaction function in actions.py.

Affected Software

7 affected components

Check Mk Project Check Mk=1.2.4

Check Mk Project Check Mk=1.2.4-p1

Check Mk Project Check Mk=1.2.4-p2

Check Mk Project Check Mk=1.2.4-p3

Check Mk Project Check Mk=1.2.5-i1

Check Mk Project Check Mk=1.2.5-i2

Check Mk Project Check Mk=1.2.5-i3

Remediation

Patch Available

http://mathias-kettner.de/check_mk_werks.php?werk_id=0982&HTML=yes

Event History

Aug 22, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5338?

CVE-2014-5338 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site scripting attacks.

How do I fix CVE-2014-5338?

To fix CVE-2014-5338, update your Check_MK installation to version 1.2.4p4 or newer, or version 1.2.5i4 or newer.

Who is affected by CVE-2014-5338?

CVE-2014-5338 affects users of Check_MK versions prior to 1.2.4p4 and 1.2.5 versions prior to 1.2.5i4.

What types of attacks are possible with CVE-2014-5338?

CVE-2014-5338 allows remote authenticated users to conduct cross-site scripting (XSS) attacks.

Is CVE-2014-5338 a local or remote vulnerability?

CVE-2014-5338 is a remote vulnerability that requires authenticated access to exploit.