Werk #11747: Fix stored XSS triggered by received syslog messages

Komponente Event Console
Titel Fix stored XSS triggered by received syslog messages
Datum 03.12.2020
Checkmk-Editon Checkmk Raw (CRE)
Checkmk-Version 1.6.0p20 2.1.0i1 2.0.0b2
Level Bedeutende Änderung
Klasse Sicherheitsfix
Kompatibilität Kompatibel - benötigt kein manuelles Eingreifen

You are only affected by this issue in case you use the Event Console.

An attacker could send messages to the Event Console, e.g. via syslog, containing arbitrary HTML code. This was executed in the browser context of any user viewing the event in the Checkmk user interface.

The information is now properly escaped in a generic way to prevent these issues.

Zur Liste aller Werks