CVE-2025-64999 - CVE House
Back to Database
Status published High CVE-2025-64999

Cross-site scripting in HTML logs of Synthetic Monitoring test services

Vulnerability Description

Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check output to inject malicious JavaScript into the Synthetic Monitoring HTML logs, which can then be accessed via a crafted phishing link.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64999

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lisa Gnedt (SBA Research)

References

More from Checkmk GmbH

View All →
CVE-2025-65000
Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule
Low 2.3
CVE-2025-64998
Session hijacking via exposed session signing secret in distributed Checkmk setups
High 7.3
CVE-2025-64997
Insufficient permission validation when showing agent information
Medium 6.3
CVE-2025-64996
Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output
Medium 4.8
CVE-2025-58122
Insufficient permission validation when configuring notification parameters
Medium 5.3

Affected Vendor

Checkmk GmbH

View all reports →

Affected Software

Checkmk
Vulnerable Versions:
2.4.0, 2.3.0

Timeline

Official Publish: February 26th, 2026
Last Modified: April 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact