CVE-2024-38857 - OpenCVE

Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://checkmk.com/werk/17059

History

No history.

MITRE

Status: PUBLISHED

Assigner: Checkmk

Published: 2024-07-02T08:11:19.241Z

Updated: 2024-08-02T04:19:20.353Z

Reserved: 2024-06-20T10:03:09.177Z

Link: CVE-2024-38857

Vulnrichment

Updated: 2024-08-02T04:19:20.353Z

NVD

Status : Awaiting Analysis

Published: 2024-07-02T08:15:06.387

Modified: 2024-07-02T12:09:16.907

Link: CVE-2024-38857

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38857", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "state": "PUBLISHED", "assignerShortName": "Checkmk", "dateReserved": "2024-06-20T10:03:09.177Z", "datePublished": "2024-07-02T08:11:19.241Z", "dateUpdated": "2024-08-02T04:19:20.353Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Checkmk", "vendor": "Checkmk GmbH", "versions": [{"lessThan": "2.3.0p8", "status": "affected", "version": "2.3.0", "versionType": "semver"}, {"lessThan": "2.2.0p28", "status": "affected", "version": "2.2.0", "versionType": "semver"}, {"lessThan": "2.1.0p45", "status": "affected", "version": "2.1.0", "versionType": "semver"}, {"lessThanOrEqual": "2.0.0p39", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "PS Positive Security GmbH"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591: Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2024-07-02T08:11:19.241Z"}, "references": [{"url": "https://checkmk.com/werk/17059"}], "title": "Reflected links in visuals facilitate phishing attacks"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T14:02:53.161004Z", "id": "CVE-2024-38857", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T14:02:59.286Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.353Z"}, "title": "CVE Program Container", "references": [{"url": "https://checkmk.com/werk/17059", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://checkmk.com/werk/17059", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.353Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38857", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-02T14:02:53.161004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T14:02:56.166Z"}}], "cna": {"title": "Reflected links in visuals facilitate phishing attacks", "credits": [{"lang": "en", "type": "reporter", "value": "PS Positive Security GmbH"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591: Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "Checkmk GmbH", "product": "Checkmk", "versions": [{"status": "affected", "version": "2.3.0", "lessThan": "2.3.0p8", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0p28", "versionType": "semver"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0p45", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.0p39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://checkmk.com/werk/17059"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2024-07-02T08:11:19.241Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38857", "state": "PUBLISHED", "dateUpdated": "2024-08-02T04:19:20.353Z", "dateReserved": "2024-06-20T10:03:09.177Z", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "datePublished": "2024-07-02T08:11:19.241Z", "assignerShortName": "Checkmk"}, "dataVersion": "5.1"}