CVE-2017-11507

MEDIUM

Check_MK 1.2.8-1.2.8p24 and 1.4.0-1.4.0p8 - Unauthenticated Cross-Site Scripting via Output Format Parameter

Title source: llm

Description

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://www.tenable.com/security/research/tra-2017-20

Vendor Advisory x_refsource_confirm

http://mathias-kettner.com/check_mk_werks.php?werk_id=7661

Scores

CVSS v3 6.1

EPSS 0.0035

EPSS Percentile 57.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

check_mk_project/check_mk 1.2.8 (37 CPE variants)

check_mk_project/check_mk 1.4.0 (13 CPE variants)

Published Dec 11, 2017

Tracked Since Feb 18, 2026