Werk #16618: Fix XSS in graph rendering

Component

Setup

Title

Fix XSS in graph rendering

Date

Apr 4, 2024

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

2.4.0b1 Not yet released	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0b4	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

Prior to this Werk a service name with html tags lead to cross site scripting in the graph rendering.

We found this vulnerability internally.

Affected Versions:

Only 2.3.0 is affected, older versions are NOT affected.

Vulnerability Management:

We have rated the issue with a CVSS Score of 4.6 (Medium) with the following CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. We assigned CVE-2024-2380 to this vulnerability.

Changes:

This Werk changes the encoding engine to use our customized JSON encoder.

To the list of all Werks