[checkmk-commits] [tribe29/checkmk] 4e6ee7: 13193 SEC XSS in report editing

Branch: refs/heads/master Home: https://github.com/tribe29/checkmk Commit: 4e6ee7d18812e164e1a6c95f3ebee2429a80a035 https://github.com/tribe29/checkmk/commit/4e6ee7d18812e164e1a6c95f3ebee2429… Author: Maximilian Wirtz <maximilian.wirtz(a)tribe29.com> Date: 2021-09-24 (Fri, 24 Sep 2021) Changed paths: A .werks/13193 Log Message: ----------- 13193 SEC XSS in report editing It was possible to Inject HTML code in various Content elments. This could also be used in shared reports. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H 9.0 Affected Versions: all below Workarounds: Disallow users to customize reports (Set 'General Permissions' > 'Customize reports and use them' to no) Exploit detections: Check `var/check_mk/web/*/user_reports.mk` for html specialchars. FEED-6407 Change-Id: I9b21735938f234579e37ef3390af955f47860531