« Volver al listado

CVE-2024-13722

Estado: AplazadaMedia (5.4)—

The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Checkmk — NagvisAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-13722",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-13722",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-05T14:56:14.228335Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "affectedData": [
        {
          "vendor": "Checkmk",
          "product": "NagVis",
          "versions": [
            {
              "status": "affected",
              "version": "NagVis 1.9.40",
              "lessThan": "1.9.42",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "Checkmk 2.3.0p2",
              "lessThan": "2.3.0p10",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-04T22:15:40.113",
  "references": [
    {
      "url": "https://checkmk.com/werks?version=2.3.0p10",
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9"
    },
    {
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2025-001.txt",
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9"
    },
    {
      "url": "https://www.nagvis.org/downloads/changelog/1.9.42",
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2025/Feb/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/02/04/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2025-001.txt",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The \"NagVis\" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users."
    },
    {
      "lang": "es",
      "value": "El componente \"NagVis\" de Checkmk es vulnerable a Cross-Site Scripting Reflejado. Un atacante puede manipule un enlace malicioso que ejecutará código JavaScript arbitrario en el contexto del navegador una vez que se haga clic en él. El ataque puede realizarse tanto en usuarios autenticados como no autenticados."
    }
  ],
  "lastModified": "2026-06-17T07:02:36.603",
  "sourceIdentifier": "bbf0bd87-ece2-41be-b873-96928ee8fab9"
}