Werk #5399: Fixed multiple stored XSS injections in GUI dialogs

Komponente Setup
Titel Fixed multiple stored XSS injections in GUI dialogs
Datum 19.10.2017
Checkmk Edition Checkmk Raw (CRE)
Checkmk-Version 1.4.0p16 1.5.0i1
Level Kleine Änderung
Klasse Sicherheitsfix
Kompatibilität Kompatibel - benötigt kein manuelles Eingreifen

It was possible to inject Javascript code to using configuration fields of different objects (users, hosts, groups, roles, timeperiods).

These issues could only be triggered by authenticated users that have permissons to use WATO and add/edit the objects mentioned above. Normally these are users with the roles admin or users.

Zur Liste aller Werks