Werk #5632: Fixed XSS when rendering values of dropdown choices

Component	User interface
Title	Fixed XSS when rendering values of dropdown choices
Date	Jan 10, 2018
Level	Trivial Change
Class	Security Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	1.5.0i3 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i3 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i3 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i3 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i3 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i3 Not yet released Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.5.0i3 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME) 1.4.0p24 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

When using the WATO configuration it was possible to create e.g. a service level definition with javascript code in it's alias. When this definition was configured in a rule of the ruleset "Service Level of Hosts", the javascript code could be executed in the browsers context of the user viewing the rule.

The insertion of the javascript code is only possible for authenticated users with the permission to configure Check_MK.

To the list of all Werks