CVE-2021-35489

Name of the Vulnerable Software and Affected Versions: Thruk versions 2.40-2

Description: The issue allows for Reflected XSS via the host or service parameter in the /thruk/#cgi-bin/extinfo.cgi API endpoint. An attacker could inject arbitrary JavaScript into extinfo.cgi, and the malicious payload would be triggered every time an authenticated user browses the page containing it.

Recommendations: For Thruk versions 2.40-2, consider disabling access to the /thruk/#cgi-bin/extinfo.cgi API endpoint until a patch is available. Restrict the use of the host and service parameters to minimize the risk of exploitation.