31 Jan
2022
31 Jan
'22
5:32 a.m.
Branch: refs/heads/1.6.0
Home: https://github.com/tribe29/checkmk
Commit: b8d7b671786cb3261d3721aae39e77e69debd1a5
https://github.com/tribe29/checkmk/commit/b8d7b671786cb3261d3721aae39e77e69…
Author: Maximilian Wirtz <maximilian.wirtz(a)tribe29.com>
Date: 2022-01-31 (Mon, 31 Jan 2022)
Changed paths:
A .werks/13716
M cmk/gui/valuespec.py
Log Message:
-----------
Pick 13719 Persistant XSS in Notification configuration
This Werk fixes a Persistant Cross-Site-Scripting (XSS) vulnerability. (CWE-79)
The <i>Alias</i> of a site was not properly escaped when shown as condition
for notifications.
To mitigate this vulnerability ensure that only trustwothy users have the
<i>Notification configuration</i> and <i>Site management</i>
rights. These are
<i>admin</i> rights by default.
Checkmk 1.6 and Checkmk 2.0 were subject to this vulnerability.
To detect if this vulnerability is/was used you can check
<tt>etc/check_mk/multisite.d/sites.mk</tt> and
<tt>etc/check_mk/conf.d/wato/notifications.mk</tt> for HTML code. Please be
aware that an attacker could delete the code after a attack.
CVE is requested and will be added later.
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N (5.2 medium)
We thank Manuel Sommer for finding this vulnerability and bringing this to our
attention.
Change-Id: Iec421c8c7ef7d0d303d00ed96724da9f6636ef20
Commit: 8c35508f26ab3033a7a511295cef4b319af48923
https://github.com/tribe29/checkmk/commit/8c35508f26ab3033a7a511295cef4b319…
Author: Maximilian Wirtz <maximilian.wirtz(a)tribe29.com>
Date: 2022-01-31 (Mon, 31 Jan 2022)
Changed paths:
A .werks/13717
M cmk/gui/wato/pages/rulesets.py
Log Message:
-----------
13717 SEC Persistant XSS in Predefined Conditions
This Werk fixes a Persistant Cross-Site-Scripting (XSS) vulnerability. (CWE-79)
The title of a <i>Predefined condition</i> is not properly escaped when shown
as condition.
No mitigation is available.
Checkmk 1.6 and Checkmk 2.0 were subject to this vulnerability.
To detect if this vulnerability is/was used you can check
<tt>etc/check_mk/conf.d/wato/predefined_conditions.mk</tt> for HTML code.
Please be aware that an attacker could delete the code after a attack.
CVE is requested and will be added later.
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N (6.3 medium)
We thank Manuel Sommer for finding this vulnerability and bringing this to our
attention.
Change-Id: Id48483af0639af06ea901e9916877b752da80b70
Compare: https://github.com/tribe29/checkmk/compare/06cfb01a1327...8c35508f26ab