Non évaluée
Cross-site scripting in HTML logs of Synthetic Monitoring test services
CVE-2025-64999
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check output to inject malicious JavaScript into the Synthetic Monitoring HTML logs, which can then be accessed via a crafted phishing link.
Références
- advisory checkmk.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov