Branch: refs/heads/1.6.0 Home: https://github.com/tribe29/checkmk Commit: b8d7b671786cb3261d3721aae39e77e69debd1a5 https://github.com/tribe29/checkmk/commit/b8d7b671786cb3261d3721aae39e77e69… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2022-01-31 (Mon, 31 Jan 2022) Changed paths: A .werks/13716 M cmk/gui/valuespec.py Log Message: ----------- Pick 13719 Persistant XSS in Notification configuration This Werk fixes a Persistant Cross-Site-Scripting (XSS) vulnerability. (CWE-79) The <i>Alias</i> of a site was not properly escaped when shown as condition for notifications. To mitigate this vulnerability ensure that only trustwothy users have the <i>Notification configuration</i> and <i>Site management</i> rights. These are <i>admin</i> rights by default. Checkmk 1.6 and Checkmk 2.0 were subject to this vulnerability. To detect if this vulnerability is/was used you can check <tt>etc/check_mk/multisite.d/sites.mk</tt> and <tt>etc/check_mk/conf.d/wato/notifications.mk</tt> for HTML code. Please be aware that an attacker could delete the code after a attack. CVE is requested and will be added later. CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N (5.2 medium) We thank Manuel Sommer for finding this vulnerability and bringing this to our attention. Change-Id: Iec421c8c7ef7d0d303d00ed96724da9f6636ef20 Commit: 8c35508f26ab3033a7a511295cef4b319af48923 https://github.com/tribe29/checkmk/commit/8c35508f26ab3033a7a511295cef4b319… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2022-01-31 (Mon, 31 Jan 2022) Changed paths: A .werks/13717 M cmk/gui/wato/pages/rulesets.py Log Message: ----------- 13717 SEC Persistant XSS in Predefined Conditions This Werk fixes a Persistant Cross-Site-Scripting (XSS) vulnerability. (CWE-79) The title of a <i>Predefined condition</i> is not properly escaped when shown as condition. No mitigation is available. Checkmk 1.6 and Checkmk 2.0 were subject to this vulnerability. To detect if this vulnerability is/was used you can check <tt>etc/check_mk/conf.d/wato/predefined_conditions.mk</tt> for HTML code. Please be aware that an attacker could delete the code after a attack. CVE is requested and will be added later. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N (6.3 medium) We thank Manuel Sommer for finding this vulnerability and bringing this to our attention. Change-Id: Id48483af0639af06ea901e9916877b752da80b70 Compare: https://github.com/tribe29/checkmk/compare/06cfb01a1327...8c35508f26ab