Werk #7661: Fixed possible stored XSS using the internal server error handler

Component omd
Title Fixed possible stored XSS using the internal server error handler
Date Jul 6, 2017
Checkmk Editon Checkmk Raw (CRE)
Checkmk Version 1.5.0i1
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed

The internal server error handler was displaying unescaped information from the error log of the webserver. When an attacker is able to add HTML code to error messages written to the error log of the web server, the internal server error handler was not escaping the HTML code when displaying it to the user.

To the list of all Werks