Checkmk 2.0 is here! See what's new.

Werk #6614: Fixed reflected XSS affecting agent updater AJAX calls

Component Agent Bakery
Title Fixed reflected XSS affecting agent updater AJAX calls
Date Sep 14, 2018
Checkmk Editon Checkmk Enterprise (CEE)
Checkmk Version 1.6.0b1 1.5.0p5
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed

When the hostname of a monitored agent is known, this could be used to exploit a reflected XSS vulnerability. Every unauthenticated or authenticated user can issue a request like this. The victim does not have to be authorized on the Check_MK application

To the list of all Werks