CVE-2024-38859: XSS in view page with SLA column

Published Aug 26, 2024

Updated

XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by other users.

Affected Software

119 affected components

CheckMK Checkmk=2.0.0

CheckMK Checkmk=2.1.0

CheckMK Checkmk=2.1.0-b1

CheckMK Checkmk=2.1.0-b2

CheckMK Checkmk=2.1.0-b3

CheckMK Checkmk=2.1.0-b4

CheckMK Checkmk=2.1.0-b5

CheckMK Checkmk=2.1.0-b6

CheckMK Checkmk=2.1.0-b7

CheckMK Checkmk=2.1.0-b8

CheckMK Checkmk=2.1.0-b9

CheckMK Checkmk=2.1.0-p1

CheckMK Checkmk=2.1.0-p10

CheckMK Checkmk=2.1.0-p11

CheckMK Checkmk=2.1.0-p12

CheckMK Checkmk=2.1.0-p13

CheckMK Checkmk=2.1.0-p14

CheckMK Checkmk=2.1.0-p15

CheckMK Checkmk=2.1.0-p16

CheckMK Checkmk=2.1.0-p17

CheckMK Checkmk=2.1.0-p18

CheckMK Checkmk=2.1.0-p19

CheckMK Checkmk=2.1.0-p2

CheckMK Checkmk=2.1.0-p20

CheckMK Checkmk=2.1.0-p21

CheckMK Checkmk=2.1.0-p22

CheckMK Checkmk=2.1.0-p23

CheckMK Checkmk=2.1.0-p24

CheckMK Checkmk=2.1.0-p25

CheckMK Checkmk=2.1.0-p26

CheckMK Checkmk=2.1.0-p27

CheckMK Checkmk=2.1.0-p28

CheckMK Checkmk=2.1.0-p29

CheckMK Checkmk=2.1.0-p3

CheckMK Checkmk=2.1.0-p30

CheckMK Checkmk=2.1.0-p31

CheckMK Checkmk=2.1.0-p32

CheckMK Checkmk=2.1.0-p33

CheckMK Checkmk=2.1.0-p34

CheckMK Checkmk=2.1.0-p35

CheckMK Checkmk=2.1.0-p36

CheckMK Checkmk=2.1.0-p37

CheckMK Checkmk=2.1.0-p38

CheckMK Checkmk=2.1.0-p39

CheckMK Checkmk=2.1.0-p4

CheckMK Checkmk=2.1.0-p40

CheckMK Checkmk=2.1.0-p41

CheckMK Checkmk=2.1.0-p42

CheckMK Checkmk=2.1.0-p43

CheckMK Checkmk=2.1.0-p44

CheckMK Checkmk=2.1.0-p45

CheckMK Checkmk=2.1.0-p46

CheckMK Checkmk=2.1.0-p5

CheckMK Checkmk=2.1.0-p6

CheckMK Checkmk=2.1.0-p7

CheckMK Checkmk=2.1.0-p8

CheckMK Checkmk=2.1.0-p9

CheckMK Checkmk=2.2.0

CheckMK Checkmk=2.2.0-b1

CheckMK Checkmk=2.2.0-b2

CheckMK Checkmk=2.2.0-b3

CheckMK Checkmk=2.2.0-b4

CheckMK Checkmk=2.2.0-b5

CheckMK Checkmk=2.2.0-b6

CheckMK Checkmk=2.2.0-b7

CheckMK Checkmk=2.2.0-b8

CheckMK Checkmk=2.2.0-i1

CheckMK Checkmk=2.2.0-p1

CheckMK Checkmk=2.2.0-p10

CheckMK Checkmk=2.2.0-p11

CheckMK Checkmk=2.2.0-p12

CheckMK Checkmk=2.2.0-p13

CheckMK Checkmk=2.2.0-p14

CheckMK Checkmk=2.2.0-p15

CheckMK Checkmk=2.2.0-p16

CheckMK Checkmk=2.2.0-p17

CheckMK Checkmk=2.2.0-p18

CheckMK Checkmk=2.2.0-p19

CheckMK Checkmk=2.2.0-p2

CheckMK Checkmk=2.2.0-p20

CheckMK Checkmk=2.2.0-p21

CheckMK Checkmk=2.2.0-p22

CheckMK Checkmk=2.2.0-p23

CheckMK Checkmk=2.2.0-p24

CheckMK Checkmk=2.2.0-p25

CheckMK Checkmk=2.2.0-p26

CheckMK Checkmk=2.2.0-p27

CheckMK Checkmk=2.2.0-p28

CheckMK Checkmk=2.2.0-p29

CheckMK Checkmk=2.2.0-p3

CheckMK Checkmk=2.2.0-p30

CheckMK Checkmk=2.2.0-p31

CheckMK Checkmk=2.2.0-p32

CheckMK Checkmk=2.2.0-p4

CheckMK Checkmk=2.2.0-p5

CheckMK Checkmk=2.2.0-p6

CheckMK Checkmk=2.2.0-p7

CheckMK Checkmk=2.2.0-p8

CheckMK Checkmk=2.2.0-p9

CheckMK Checkmk=2.3.0

CheckMK Checkmk=2.3.0-b1

CheckMK Checkmk=2.3.0-b2

CheckMK Checkmk=2.3.0-b3

CheckMK Checkmk=2.3.0-b4

CheckMK Checkmk=2.3.0-b5

CheckMK Checkmk=2.3.0-b6

CheckMK Checkmk=2.3.0-p1

CheckMK Checkmk=2.3.0-p10

CheckMK Checkmk=2.3.0-p11

CheckMK Checkmk=2.3.0-p12

CheckMK Checkmk=2.3.0-p13

CheckMK Checkmk=2.3.0-p2

CheckMK Checkmk=2.3.0-p3

CheckMK Checkmk=2.3.0-p4

CheckMK Checkmk=2.3.0-p5

CheckMK Checkmk=2.3.0-p6

CheckMK Checkmk=2.3.0-p7

CheckMK Checkmk=2.3.0-p8

CheckMK Checkmk=2.3.0-p9

Event History

Aug 26, 2024

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-38859?

CVE-2024-38859 has a severity rating that allows attackers to execute arbitrary scripts through Cross-Site Scripting (XSS) vulnerabilities.

How do I fix CVE-2024-38859?

To fix CVE-2024-38859, upgrade to Checkmk versions 2.3.0p14, 2.2.0p33, 2.1.0p47, or later.

Which versions of Checkmk are affected by CVE-2024-38859?

CVE-2024-38859 affects Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47, and 2.0.0.

What type of vulnerability is CVE-2024-38859?

CVE-2024-38859 is a Cross-Site Scripting (XSS) vulnerability that can be exploited through the SLA column in Checkmk.

Who is impacted by CVE-2024-38859?

Users of Checkmk running vulnerable versions before the specified patches are at risk of exploitation from this vulnerability.