Werk #5654: Fixed XSS on the site management page

KomponenteGUI
TitelFixed XSS on the site management page
Datum2018-01-24 14:56:56
Check_MK EditionCheck_MK Raw Edition (CRE)
Check_MK Version1.4.0p24,1.5.0i3
LevelTrivial Change
KlasseSecurity Fix
KompatibilitätKompatibel - benötigt kein manuelles Eingreifen

When using the WATO configuration it was possible to create a site on the distributed monitoring page which uses with javascript code in it's alias. When this site was later displayed in the site tables, the javascript code could be executed in the browsers context of the user viewing the table.

The insertion of the javascript code is only possible for authenticated users with the permission to configure Check_MK sites.