CVE-2024-13722
Checkmk NagVis Reflected Cross-site Scripting
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Checkmk NagVis Reflected Cross-site Scripting
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
CVE-2024-13722- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-51735
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
EUVD-2024-51735- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-237v-gpwr-jc57
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An...
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
GHSA-237v-gpwr-jc57- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
CVE-2024-13722- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-13722
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
DEBIAN-CVE-2024-13722- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-13722
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
UBUNTU-CVE-2024-13722- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSV No score
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Record
CVE-2024-13722- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nagvisDebian:12 |
All versions, plus listed versions 1:1.10.0-11:1.10.1-11:1.10.2-11:1.10.3-11:1.10.4-1 Show 21 moreShow less1:1.10.5-11:1.10.6-11:1.10.7-11:1.9.34-11:1.9.35-11:1.9.35-1~exp11:1.9.36-11:1.9.37-11:1.9.38-11:1.9.39-11:1.9.40-11:1.9.41-11:1.9.42-11:1.9.43-11:1.9.44-11:1.9.45-11:1.9.46-11:1.9.47-11:1.9.47-1~exp11:1.9.48-11:1.9.49-1 |
None known |
nagvisDebian:13 |
before 1:1.9.42-1 | 1:1.9.42-1 |
nagvisDebian:14 |
before 1:1.9.42-1 | 1:1.9.42-1 |
nagvisDebian:11 From an advisory covering 7 CVEs |
before 1:1.9.25-2+deb11u1, plus listed versions 1:1.9.25-2 |
1:1.9.25-2+deb11u1 |
check-mkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.6p5-11.2.6p12-11.2.6p12-1ubuntu0.16.04.11.2.6p12-1ubuntu0.16.04.1+esm1 |
None known |
nagvisUbuntu:16.04:LTS |
All versions, plus listed versions 1:1.7.10+dfsg1-31:1.7.10+dfsg1-3ubuntu1 |
None known |
check-mkUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.8p16-1ubuntu0.11.2.8p16-1ubuntu0.2 |
None known |
nagvisUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.7.10+dfsg1-3.2 |
None known |
nagvisUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.9.25-21:1.9.27-11:1.9.28-11:1.9.29-11:1.9.30-1 |
None known |
nagvisUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.9.36-11:1.9.38-11:1.9.39-11:1.9.40-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-13722 is a medium vulnerability (CVSS 5.4) in Checkmk Nagvis, published February 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in nagvis 1:1.9.42-1.