Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Thu, 04 Dec 2025 05:15:00 +0900

Type Values Removed Values Added
Weaknesses CWE-79
CPEs cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p16:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p17:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p18:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p19:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p20:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p21:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p22:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p23:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p24:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p25:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p26:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p27:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p28:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p29:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p30:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p31:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p32:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p33:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p34:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p35:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p36:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p37:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p38:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:-:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p10:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p11:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p12:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p13:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p1:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p2:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p3:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p4:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p5:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p6:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p7:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p9:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H'}


Sat, 08 Nov 2025 01:30:00 +0900

Type Values Removed Values Added
References

Thu, 30 Oct 2025 23:45:00 +0900

Type Values Removed Values Added
First Time appeared Checkmk
Checkmk checkmk
Vendors & Products Checkmk
Checkmk checkmk

Thu, 30 Oct 2025 23:15:00 +0900

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 30 Oct 2025 19:45:00 +0900

Type Values Removed Values Added
Description Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).
Title Cross Site Scripting through compromised remote site
Weaknesses CWE-80
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Checkmk

Published:

Updated: 2025-11-07T16:04:27.994Z

Reserved: 2025-04-16T07:07:38.256Z

Link: CVE-2025-39663

cve-icon Vulnrichment

Updated: 2025-11-07T16:04:27.994Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-30T11:15:32.400

Modified: 2025-12-03T20:06:16.960

Link: CVE-2025-39663

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-10-30T23:37:25Z

Weaknesses