Werk #8881: Fix possible XSS issue on "confirm failed notifications" page

Component

User interface

Title

Fix possible XSS issue on "confirm failed notifications" page

Date

Sep 4, 2019

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

2.0.0i1	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)
1.6.0b9	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

Using a manipulated notification script or notification destination system it was possible to inject javascript code into the "confirm failed notifications" page.

To prevent users from this potential issue, you could remove the permission for viewing the failed notifications from the users roles.

To the list of all Werks