Read the docs
TI-2024-12761 Aliases CVE-2024-13722GHSA-237v-gpwr-jc57

Checkmk NagVis Reflected Cross-site Scripting

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Fix Fixed NagVis (Checkmk): 1.9.42, 2.3.0p10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Checkmk GmbHNagVisNagVis 1.9.40 to before 1.9.42; Checkmk 2.3.0p2 to before 2.3.0p101.9.42, 2.3.0p10Patch availableCNA
  • NagVis VendorCheckmk GmbH Affected NagVis 1.9.40 to before 1.9.42; Checkmk 2.3.0p2 to before 2.3.0p10 Fixed in 1.9.42, 2.3.0p10 Patch available CNA

Remediation

  • Fix · CNA NagVis (Checkmk) Fixed in 1.9.42, 2.3.0p10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Checkmk NagVis 1.9.42, 2.3.0p10

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2024-12762 Checkmk NagVis Remote Code ExecutionPriority HIGH 67
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13722
  2. 2026-10-03 Alias added: GHSA-237v-gpwr-jc57

References

Advisory 1

Other 2

  • TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
  • TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
  • TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
  • TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
  • TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8
  • TI-2021-17818 The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does… CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences