CVE-2024-28831

What it actually does

Stored cross-site scripting vulnerability allowing injection of arbitrary HTML/JS into user input fields that render in confirmation pop-ups, enabling script execution in other users' browsers with the application's privileges.

Why it matters to the business

Attackers can hijack user sessions, steal monitoring data, or perform unauthorized actions inside the Checkmk console, potentially disrupting infrastructure visibility and operations; low exploit probability reduces immediate urgency but still requires patching.

How an attack unfolds

An authenticated low-privileged user supplies malicious HTML or script content into fields that later appear in confirmation dialogs; when another user triggers the dialog, the injected code executes in their browser context without further interaction.

How to fix it

Upgrade Checkmk to version 2.3.0p7 or 2.2.0p28 or later; if immediate upgrade is not possible, restrict untrusted user input and monitor for suspicious HTML in relevant fields.

How to confirm the fix worked

After upgrade, verify the vulnerable input paths no longer render raw HTML in pop-ups by re-testing with benign script markers; confirm version numbers match or exceed the fixed releases.

Typical attack path

1. Obtain a low-privileged Checkmk user account
2. Locate input fields that feed into confirmation pop-ups
3. Inject crafted HTML/JS payload into the field and save
4. Wait for or social-engineer a higher-privileged user to view the confirmation dialog
5. Script executes, performing actions such as cookie theft or API calls

How to detect it

Review web server and application logs for unexpected HTML tags or script elements in fields that populate confirmation dialogs; check browser developer tools or proxy captures for unusual script execution originating from Checkmk pages.

What your security team should do

• Prioritize upgrade to 2.3.0p7 or 2.2.0p28 within standard change windows given low EPSS and no KEV listing
• Audit current Checkmk user permissions to limit who can supply data to confirmation-related fields
• Add web application firewall rules or input sanitization if upgrades are delayed