This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Checkmk dashboard URL widget. Specifically, users with dashboard editing permissions can insert URLs with dangerous schemes like javascript:, which are stored and later executed in other users' browsers when they access the dashboard. This stored XSS can lead to script execution impacting confidentiality, integrity, and availability as indicated by the CVSS vector. Affected versions include Checkmk prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions. The vendor has not provided a patch or official remediation guidance at this time.

Successful exploitation allows an attacker with dashboard editing permissions to execute arbitrary scripts in the browsers of other users viewing the dashboard. This can lead to compromise of user sessions, theft of sensitive information, or other malicious actions impacting confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS 4.0 score of 8.5, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict dashboard editing permissions to trusted users only to reduce the risk of exploitation. Monitor vendor communications for updates on patches or mitigations. Avoid allowing untrusted users to create or modify dashboard URLs containing potentially dangerous URI schemes.