CVE-2014-5338

CVE-2014-5338 describes multiple cross-site scripting (XSS) vulnerabilities within the multisite component of Check_MK versions prior to 1.2.4p4 and 1.2.5i4. These flaws, specifically in the render_status_icons and ajax_action functions, allow authenticated attackers to inject arbitrary web scripts or HTML. The vulnerability has a CVSS score of 3.5 (Medium), indicating a network-based attack with medium complexity requiring authentication, leading to potential information disclosure (C:N/I:P/A:N). While the direct impact is limited to client-side script execution, it could facilitate further attacks. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. It is not listed on the CISA KEV catalog.