CVE-2017-11507: XSS

Published Dec 11, 2017

Updated

A cross site scripting (XSS) vulnerability exists in CheckMK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the outputformat parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

Affected Software

56 affected components

Check Mk Project Check Mk=1.2.8

Check Mk Project Check Mk=1.2.8-b1

Check Mk Project Check Mk=1.2.8-b10

Check Mk Project Check Mk=1.2.8-b11

Check Mk Project Check Mk=1.2.8-b2

Check Mk Project Check Mk=1.2.8-b3

Check Mk Project Check Mk=1.2.8-b4

Check Mk Project Check Mk=1.2.8-b5

Check Mk Project Check Mk=1.2.8-b6

Check Mk Project Check Mk=1.2.8-b7

Check Mk Project Check Mk=1.2.8-b8

Check Mk Project Check Mk=1.2.8-b9

Check Mk Project Check Mk=1.2.8-p1

Check Mk Project Check Mk=1.2.8-p10

Check Mk Project Check Mk=1.2.8-p11

Check Mk Project Check Mk=1.2.8-p12

Check Mk Project Check Mk=1.2.8-p13

Check Mk Project Check Mk=1.2.8-p14

Check Mk Project Check Mk=1.2.8-p15

Check Mk Project Check Mk=1.2.8-p16

Check Mk Project Check Mk=1.2.8-p17

Check Mk Project Check Mk=1.2.8-p18

Check Mk Project Check Mk=1.2.8-p19

Check Mk Project Check Mk=1.2.8-p2

Check Mk Project Check Mk=1.2.8-p20

Check Mk Project Check Mk=1.2.8-p21

Check Mk Project Check Mk=1.2.8-p22

Check Mk Project Check Mk=1.2.8-p23

Check Mk Project Check Mk=1.2.8-p24

Check Mk Project Check Mk=1.2.8-p25

Check Mk Project Check Mk=1.2.8-p3

Check Mk Project Check Mk=1.2.8-p4

Check Mk Project Check Mk=1.2.8-p5

Check Mk Project Check Mk=1.2.8-p6

Check Mk Project Check Mk=1.2.8-p7

Check Mk Project Check Mk=1.2.8-p8

Check Mk Project Check Mk=1.2.8-p9

Check Mk Project Check Mk=1.4.0

Check Mk Project Check Mk=1.4.0-b1

Check Mk Project Check Mk=1.4.0-b2

Check Mk Project Check Mk=1.4.0-b3

Check Mk Project Check Mk=1.4.0-b4

Check Mk Project Check Mk=1.4.0-b5

Check Mk Project Check Mk=1.4.0-b6

Check Mk Project Check Mk=1.4.0-b7

Check Mk Project Check Mk=1.4.0-b8

Check Mk Project Check Mk=1.4.0-b9

Check Mk Project Check Mk=1.4.0-p1

Check Mk Project Check Mk=1.4.0-p2

Check Mk Project Check Mk=1.4.0-p3

Check Mk Project Check Mk=1.4.0-p4

Check Mk Project Check Mk=1.4.0-p5

Check Mk Project Check Mk=1.4.0-p6

Check Mk Project Check Mk=1.4.0-p7

Check Mk Project Check Mk=1.4.0-p8

Check Mk Project Check Mk=1.4.0-p9

Event History

Dec 11, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-11507?

CVE-2017-11507 is categorized as a medium severity vulnerability due to its potential for exploitation by unauthenticated attackers.

How do I fix CVE-2017-11507?

To fix CVE-2017-11507, upgrade Check_MK to version 1.2.8p25, or 1.4.0p9 or later.

Which versions of Check_MK are affected by CVE-2017-11507?

Versions affected by CVE-2017-11507 include Check_MK 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9.

What type of vulnerability is CVE-2017-11507?

CVE-2017-11507 is a cross-site scripting (XSS) vulnerability that allows for the injection of arbitrary HTML or JavaScript.

What can an attacker achieve with CVE-2017-11507?

An attacker exploiting CVE-2017-11507 can execute arbitrary scripts in the context of the user's browser, potentially leading to data theft or session hijacking.