HIGH🇵🇱 Wersja polska

CVE-2026-3466

CVSS 8.5v4.0pub. 2026-04-07upd. 2026-04-22

Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Checkmk

    APP
    Checkmk
    2.2.02.3.02.4.02.5.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2025-39666CRITICAL9.3PL ✓same product

Local privilege escalation w Checkmk — eskalacja do root przez manipulację plikami

CVE-2024-8606CRITICAL9.2PL ✓same product

Pominięcie uwierzytelnienia dwuskładnikowego (2FA) w Checkmk RestAPI

CVE-2022-46836CRITICAL9.1PL ✓same product

PHP code injection w Checkmk — wstrzyknięcie i wykonanie kodu PHP (RCE)

CVE-2026-7186HIGH8.5same product

Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2...

CVE-2026-8833HIGH8.5same product

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p...