Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
References
| Link | Resource |
|---|---|
| https://checkmk.com/werk/19033 | Vendor Advisory |
| https://checkmk.com/werk/19583 | |
| https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title | Release Notes Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-04-07 13:16
Updated : 2026-06-17 10:43
NVD link : CVE-2026-3466
Mitre link : CVE-2026-3466
CVE.ORG link : CVE-2026-3466
JSON object : View
Products Affected
checkmk
- checkmk
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
