Werk #5399: Fixed multiple stored XSS injections in WATO dialogs

KomponenteWATO
TitelFixed multiple stored XSS injections in WATO dialogs
Datum2017-10-19 15:37:05
Checkmk EditionCheckmk Raw Edition (CRE)
Checkmk Version1.4.0p16,1.5.0i1
LevelTrivial Change
KlasseSecurity Fix
KompatibilitätKompatibel - benötigt kein manuelles Eingreifen

It was possible to inject Javascript code to using configuration fields of different objects (users, hosts, groups, roles, timeperiods).

These issues could only be triggered by authenticated users that have permissons to use WATO and add/edit the objects mentioned above. Normally these are users with the roles admin or users.