In all previous 1.2.8 versions authenticated and privileged WATO users,
the ones which are able to add or edit hosts, were able to inject shell
commands to Check_MK which are then executed in the context of the monitoring
The user was able to configure a host address in a specific format to inject
such shell commands to the configuration. Once the configuration was activated
and loaded into the monitoring core, the command was executed in context of
the monitoring site user in the moment a parent scan was started for that host.
Thanks for analyzing and reporting this issue to Christian Fünfhaus!
To the list of all Werks