Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.
References
| Link | Resource |
|---|---|
| https://checkmk.com/werk/17992 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-06-08 13:16
Updated : 2026-07-23 07:10
NVD link : CVE-2026-8078
Mitre link : CVE-2026-8078
CVE.ORG link : CVE-2026-8078
JSON object : View
Products Affected
checkmk
- checkmk
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
