This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Checkmk dashboard dashlet title links. Versions 2.2.0 (EOL), 2.3.0 before 2.3.0p46, 2.4.0 before 2.4.0p25, and 2.5.0 beta before 2.5.0 allow an attacker with dashboard creation privileges to inject stored XSS payloads. When a victim clicks the crafted dashlet title link on a shared dashboard, the malicious script executes in their browser, potentially leading to high-impact consequences such as session hijacking or privilege escalation within the web application context. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond dashboard creation, user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

Successful exploitation allows stored cross-site scripting attacks, enabling attackers to execute arbitrary scripts in the context of the victim's browser session within Checkmk. This can lead to theft of sensitive information, session hijacking, or manipulation of the web application interface. The vulnerability requires the attacker to have dashboard creation privileges and the victim to interact by clicking the crafted link. The high CVSS score reflects the significant potential impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict dashboard creation privileges to trusted users only and educate users to avoid clicking untrusted dashlet title links on shared dashboards. Monitor vendor communications for updates on patches or official mitigations.