6.1

CVE-2017-11507

Exploit
A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Check Mk Project ≫ Check Mk Version 1.2.8
Check Mk Project ≫ Check Mk Version 1.2.8 Update b1
Check Mk Project ≫ Check Mk Version 1.2.8 Update b10
Check Mk Project ≫ Check Mk Version 1.2.8 Update b11
Check Mk Project ≫ Check Mk Version 1.2.8 Update b2
Check Mk Project ≫ Check Mk Version 1.2.8 Update b3
Check Mk Project ≫ Check Mk Version 1.2.8 Update b4
Check Mk Project ≫ Check Mk Version 1.2.8 Update b5
Check Mk Project ≫ Check Mk Version 1.2.8 Update b6
Check Mk Project ≫ Check Mk Version 1.2.8 Update b7
Check Mk Project ≫ Check Mk Version 1.2.8 Update b8
Check Mk Project ≫ Check Mk Version 1.2.8 Update b9
Check Mk Project ≫ Check Mk Version 1.2.8 Update p1
Check Mk Project ≫ Check Mk Version 1.2.8 Update p10
Check Mk Project ≫ Check Mk Version 1.2.8 Update p11
Check Mk Project ≫ Check Mk Version 1.2.8 Update p12
Check Mk Project ≫ Check Mk Version 1.2.8 Update p13
Check Mk Project ≫ Check Mk Version 1.2.8 Update p14
Check Mk Project ≫ Check Mk Version 1.2.8 Update p15
Check Mk Project ≫ Check Mk Version 1.2.8 Update p16
Check Mk Project ≫ Check Mk Version 1.2.8 Update p17
Check Mk Project ≫ Check Mk Version 1.2.8 Update p18
Check Mk Project ≫ Check Mk Version 1.2.8 Update p19
Check Mk Project ≫ Check Mk Version 1.2.8 Update p2
Check Mk Project ≫ Check Mk Version 1.2.8 Update p20
Check Mk Project ≫ Check Mk Version 1.2.8 Update p21
Check Mk Project ≫ Check Mk Version 1.2.8 Update p22
Check Mk Project ≫ Check Mk Version 1.2.8 Update p23
Check Mk Project ≫ Check Mk Version 1.2.8 Update p24
Check Mk Project ≫ Check Mk Version 1.2.8 Update p25
Check Mk Project ≫ Check Mk Version 1.2.8 Update p3
Check Mk Project ≫ Check Mk Version 1.2.8 Update p4
Check Mk Project ≫ Check Mk Version 1.2.8 Update p5
Check Mk Project ≫ Check Mk Version 1.2.8 Update p6
Check Mk Project ≫ Check Mk Version 1.2.8 Update p7
Check Mk Project ≫ Check Mk Version 1.2.8 Update p8
Check Mk Project ≫ Check Mk Version 1.2.8 Update p9
Check Mk Project ≫ Check Mk Version 1.4.0
Check Mk Project ≫ Check Mk Version 1.4.0 Update b1
Check Mk Project ≫ Check Mk Version 1.4.0 Update b2
Check Mk Project ≫ Check Mk Version 1.4.0 Update b3
Check Mk Project ≫ Check Mk Version 1.4.0 Update b4
Check Mk Project ≫ Check Mk Version 1.4.0 Update b5
Check Mk Project ≫ Check Mk Version 1.4.0 Update b6
Check Mk Project ≫ Check Mk Version 1.4.0 Update b7
Check Mk Project ≫ Check Mk Version 1.4.0 Update b8
Check Mk Project ≫ Check Mk Version 1.4.0 Update b9
Check Mk Project ≫ Check Mk Version 1.4.0 Update p1
Check Mk Project ≫ Check Mk Version 1.4.0 Update p2
Check Mk Project ≫ Check Mk Version 1.4.0 Update p3
Check Mk Project ≫ Check Mk Version 1.4.0 Update p4
Check Mk Project ≫ Check Mk Version 1.4.0 Update p5
Check Mk Project ≫ Check Mk Version 1.4.0 Update p6
Check Mk Project ≫ Check Mk Version 1.4.0 Update p7
Check Mk Project ≫ Check Mk Version 1.4.0 Update p8
Check Mk Project ≫ Check Mk Version 1.4.0 Update p9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.03% 0.592
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://mathias-kettner.com/check_mk_werks.php?werk_id=7661
Vendor Advisory
https://www.tenable.com/security/research/tra-2017-20
Third Party Advisory
Exploit