Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2017-11507

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrar

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tenable

Description

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Tenable Check_MK

  • 1.2.8x prior to 1. 2.8p25affected
  • 1.4.0x prior to 1.4.0p9affected

References