What’s Vulnerable › Vulnerabilities
CVE-2024-28832: XSS in Crash Report Page
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-06-25 · updated 2026-06-17
- Weakness: CWE-80
Description
Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Settings to execute arbitrary scripts by injecting HTML elements into the Crash Report URL in the Global Settings.
Affected products
- Checkmk GmbH Checkmk: through 2.0.0; 2.1.0, 2.1.0-b1, 2.1.0-b2, 2.1.0-b3, 2.1.0-b4, 2.1.0-b5 (+98)
References
Get alerted when CVE-2024-28832 or the next vulnerability affects your stack