Werk #5399: Fixed multiple stored XSS injections in GUI dialogs

Component	Setup
Title	Fixed multiple stored XSS injections in GUI dialogs
Date	Oct 19, 2017
Level	Trivial Change
Class	Security Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	1.5.0i1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i1 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i1 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.4.0p16 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

It was possible to inject Javascript code to using configuration fields of different objects (users, hosts, groups, roles, timeperiods).

These issues could only be triggered by authenticated users that have permissons to use WATO and add/edit the objects mentioned above. Normally these are users with the roles admin or users.

To the list of all Werks