Werk #6618: Fixed missing CSRF protection for host diagnostic AJAX calls

Name: checkmk
Rating: 4.7 (114 reviews)

Component

Setup

Title

Fixed missing CSRF protection for host diagnostic AJAX calls

Date

Sep 17, 2018

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

1.6.0b1	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)
1.5.0p5	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)
1.4.0p36	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

The AJAX calls used by the host diagnostic page were not correctly using CSRF tokens to protect logged in users against malicious links that could trigger actions.

To the list of all Werks