CVE-2017-9781MEDIUM
Description
A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.
References
Details
Source: MITRE
Published: 2017-06-21
Updated: 2019-04-22
Type: CWE-79
Risk Information
CVSS v2.0
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3.0
Base Score: 6.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Impact Score: 2.7
Exploitability Score: 2.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 101089 | Check_MK < 1.4.0p6 webapi.py XSS | Nessus | CGI abuses : XSS | medium |