[checkmk-commits] [tribe29/checkmk] ea4f9f: 13193 SEC XSS in report editing

Branch: refs/heads/2.0.0 Home: https://github.com/tribe29/checkmk Commit: ea4f9f77d1a4efc55efac0fd3d5a53087c903953 https://github.com/tribe29/checkmk/commit/ea4f9f77d1a4efc55efac0fd3d5a53087… Author: Maximilian Wirtz <maximilian.wirtz(a)tribe29.com> Date: 2021-09-24 (Fri, 24 Sep 2021) Changed paths: A .werks/13193 Log Message: ----------- 13193 SEC XSS in report editing It was possible to Inject HTML code in various Content elments. This could also be used in shared reports. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H 9.0 Affected Versions: all below Workarounds: Disallow users to customize reports (Set 'General Permissions' > 'Customize reports and use them' to no) Exploit detections: Check `var/check_mk/web/*/user_reports.mk` for html specialchars. FEED-6407 Change-Id: I45be0dc7ad4e4932766f2f018a225afffdd52bef