Werk #16618: Fix XSS in graph rendering

Component Setup
Title Fix XSS in graph rendering
Date Apr 4, 2024
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.4.0b1 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0b4 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

Prior to this Werk a service name with html tags lead to cross site scripting in the graph rendering.

We found this vulnerability internally.

Affected Versions:

Only 2.3.0 is affected, older versions are NOT affected.

Vulnerability Management:

We have rated the issue with a CVSS Score of 4.6 (Medium) with the following CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. We assigned CVE-2024-2380 to this vulnerability.

Changes:

This Werk changes the encoding engine to use our customized JSON encoder.

To the list of all Werks