Werk #1052: index start URL can not be used to redirect to absolute URLs anymore

Name: checkmk
Rating: 4.7 (114 reviews)

Component

User interface

Title

index start URL can not be used to redirect to absolute URLs anymore

Date

Jul 4, 2014

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

1.2.5i5	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

An attacker could make a user open up an URL to a compromised website which the does not want to open index.py?start_url=http://(url to compromised URL).

To the list of all Werks