A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

The version of Check_MK running on the remote web server is affected by a reflected cross-site (XSS) scripting vulnerability in the Internal Server Error page, due to improper encoding of error log output. An unauthenticated, remote attacker can exploit this to execute arbitrary script code in a user's browser session.

Detections

Analytics

CVE-2017-11507

medium

Tenable Plugins

medium