Werk #5399: Fixed multiple stored XSS injections in GUI dialogs

Komponente

Setup

Titel

Fixed multiple stored XSS injections in GUI dialogs

Datum

19.10.2017

Level

Kleine Änderung

Klasse

Sicherheitsfix

Kompatibilität

Kompatibel - benötigt kein manuelles Eingreifen

Checkmk versions & editions

1.5.0i1	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)
1.4.0p16	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

It was possible to inject Javascript code to using configuration fields of different objects (users, hosts, groups, roles, timeperiods).

These issues could only be triggered by authenticated users that have permissons to use WATO and add/edit the objects mentioned above. Normally these are users with the roles admin or users.

Zur Liste aller Werks