CVE-2025-39663

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39663
Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://checkmk.com/werk/17998 Vendor Advisory
https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting Exploit Third Party Advisory
http://seclists.org/fulldisclosure/2025/Nov/0 Exploit Mailing List Third Party Advisory
https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p16:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p17:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p18:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p19:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p20:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p21:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p22:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p23:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p24:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p25:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p26:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p27:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p28:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p29:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p30:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p31:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p32:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p33:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p34:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p35:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p36:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p37:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p38:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:-:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p1:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p10:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p11:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p12:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p13:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p2:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p3:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p4:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p5:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p6:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p7:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p9:*:*:*:*:*:*
History

03 Dec 2025, 20:06

Type Values Removed Values Added
CPE cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p3:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p32:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p33:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p31:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p1:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p22:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p23:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p38:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p28:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p11:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p17:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p30:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p13:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p35:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p5:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p16:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p27:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p36:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p24:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p26:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p10:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p9:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p37:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p18:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p6:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p12:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:-:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p4:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p7:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.4.0:p2:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p21:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p29:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p19:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p20:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p34:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p25:*:*:*:*:*:*
cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*
CWE CWE-79
First Time Checkmk checkmk
Checkmk
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.4
References () https://checkmk.com/werk/17998 - () https://checkmk.com/werk/17998 - Vendor Advisory
References () https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting - () https://github.com/sbaresearch/advisories/tree/82fd27e4570433464c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting - Exploit, Third Party Advisory
References () http://seclists.org/fulldisclosure/2025/Nov/0 - () http://seclists.org/fulldisclosure/2025/Nov/0 - Exploit, Mailing List, Third Party Advisory

07 Nov 2025, 16:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2025/Nov/0 -
Information

Published : 2025-10-30 11:15

Updated : 2025-12-03 20:06

NVD link : CVE-2025-39663

Mitre link : CVE-2025-39663

CVE.ORG link : CVE-2025-39663

JSON object : View

Products Affected

checkmk

  • checkmk
CWE
CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')