CVE-2017-11507

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-12-11 · updated 2026-06-17
Weakness: CWE-79

Description

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

Affected products

Tenable Check_MK: 1.2.8, 1.2.8-b1, 1.2.8-b10, 1.2.8-b11, 1.2.8-b2, 1.2.8-b3 (+50)

References

http://mathias-kettner.com/check_mk_werks.php?werk_id=7661
https://www.tenable.com/security/research/tra-2017-20
http://mathias-kettner.com/check_mk_werks.php?werk_id=7661
https://www.tenable.com/security/research/tra-2017-20

Get alerted when CVE-2017-11507 or the next vulnerability affects your stack