CVE-2017-9781

MEDIUM

Check_MK <1.4.0p6 - XSS

Title source: llm

Description

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.

References (2)

[Various Sources] http://git.mathias-kettner.de/git/?p=check_mk.git%3Ba=blob%3Bf=.werks/4757%3Bhb=c248f0b6ff7b15ced9f07a3df8a80fad656ea5b1

[Exploit, Third Party Advisory] https://www.tenable.com/security/research/tra-2017-21

Scores

CVSS v3 6.1

EPSS 0.0040

EPSS Percentile 60.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (7)

check_mk_project/check_mk

n/a/n/a

Published Jun 21, 2017

Tracked Since Feb 18, 2026