A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.
References
Link | Resource |
---|---|
http://mathias-kettner.com/check_mk_werks.php?werk_id=7661 | Vendor Advisory |
https://www.tenable.com/security/research/tra-2017-20 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: tenable
Published: 2017-07-06T00:00:00
Updated: 2017-12-11T15:57:01
Reserved: 2017-07-21T00:00:00
Link: CVE-2017-11507
JSON object: View
NVD Information
Status : Analyzed
Published: 2017-12-11T16:29:00.203
Modified: 2017-12-26T18:10:10.273
Link: CVE-2017-11507
JSON object: View
Redhat Information
No data.
CWE