CVE-2014-2329

Published: 31 August 2015

Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by the logwatch module, or other unspecified vectors.

Priority

Status

Package	Release	Status
check-mk Launchpad, Ubuntu, Debian	precise	Ignored (end of life)
	trusty	Does not exist (trusty was not-affected [1.2.2p3-1])
	upstream	Released (1.2.2p3-1)
	vivid	Not vulnerable
	wily	Not vulnerable
	xenial	Not vulnerable
	yakkety	Not vulnerable
	zesty	Not vulnerable

References

http://packetstormsecurity.com/files/125850/DTC-A-20140324-002.txt
https://www.cve.org/CVERecord?id=CVE-2014-2329
NVD
Launchpad
Debian

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742689

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›