CVE-2024-28831: Checkmk

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up.

Affected products

• Checkmk Checkmk: up to and including 2.2.0; version 2.2.0 only; version 2.3.0 only

Published 2024-06-25. Last modified 2026-06-17.