Werk #5399: Fixed multiple stored XSS injections in GUI dialogs
| Component | Setup |
| Title | Fixed multiple stored XSS injections in GUI dialogs |
| Date | Oct 19, 2017 |
| Checkmk Edition | Checkmk Raw (CRE) |
| Checkmk Version | 1.4.0p16 1.5.0i1 |
| Level | Trivial Change |
| Class | Security Fix |
| Compatibility | Compatible - no manual interaction needed |
It was possible to inject Javascript code to using configuration fields of different objects (users, hosts, groups, roles, timeperiods).
These issues could only be triggered by authenticated users that have permissons to use WATO and add/edit the objects mentioned above. Normally these are users with the roles admin or users.
