CVE-2017-11507 : A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

Published 2017-12-11 16:29:00

Updated 2017-12-26 18:10:10

Source Tenable Network Security, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2017-11507

Check Mk Project » Check Mk » Version: 1.4.0 Update B1
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b1:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B3
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b3:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8
cpe:2.3:a:check_mk_project:check_mk:1.2.8:*:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B2
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b2:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B9
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b9:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B11
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b11:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P5
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P7
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p7:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P5
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p5:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P7
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p7:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P14
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p14:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P16
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p16:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P21
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p21:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P23
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p23:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0
cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B3
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b3:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B4
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b4:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B5
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b5:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B6
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b6:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B7
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b7:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P9
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p9:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P1
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p1:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P2
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p2:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P3
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p3:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P17
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p17:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P18
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p18:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P19
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p19:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P20
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p20:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B5
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b5:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B6
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b6:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B7
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b7:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B8
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b8:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P1
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P2
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P3
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P4
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P8
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p8:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P9
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p9:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P10
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p10:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P11
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p11:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P12
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p12:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P25
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p25:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B2
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b2:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B4
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b4:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update B9
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b9:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B1
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b1:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B8
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b8:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update B10
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b10:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P6
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p6:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.4.0 Update P8
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p8:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P4
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p4:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P6
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p6:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P13
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p13:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P15
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p15:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P22
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p22:*:*:*:*:*:*
Matching versions
Check Mk Project » Check Mk » Version: 1.2.8 Update P24
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p24:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-11507

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 41 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-11507

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2017-11507

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-11507

https://www.tenable.com/security/research/tra-2017-20

[R2] Check_MK Multisite Web UI Stored and Reflected XSS - Research Advisory | Tenable®
Exploit;Third Party Advisory
http://mathias-kettner.com/check_mk_werks.php?werk_id=7661

Fixed possible stored XSS using the internal server error handler (Werk #7661) | checkmk
Vendor Advisory

Jump to

Vulnerability Details : CVE-2017-11507

Products affected by CVE-2017-11507

Exploit prediction scoring system (EPSS) score for CVE-2017-11507

CVSS scores for CVE-2017-11507

CWE ids for CVE-2017-11507

References for CVE-2017-11507