Unrated
Cross-site scripting in HTML logs of Synthetic Monitoring test services
CVE-2025-64999
First seen on SecPulse
Original description The description as published by the source.
Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check output to inject malicious JavaScript into the Synthetic Monitoring HTML logs, which can then be accessed via a crafted phishing link.
References
- advisory checkmk.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov