What’s Vulnerable › Vulnerabilities

CVE-2021-40906

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-25 · updated 2026-07-09
• Weakness: CWE-79

Description

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.

Affected products

• Checkmk GmbH Checkmk: from 1.5.0 before 1.6.0; 1.6.0, 1.6.0-b1, 1.6.0-b10, 1.6.0-b12, 1.6.0-b3, 1.6.0-b4 (+25) — fixed in 1.6.0
• Tribe29 Checkmk: 1.6.0b10, 1.6.0b11, 1.6.0p10, 1.6.0p17, 1.6.0p18

How to fix

Upgrade to a fixed version: Checkmk GmbH Checkmk 1.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/Edgarloyola/CVE-2021-40906
• https://github.com/Edgarloyola/CVE-2021-40906

Get alerted when CVE-2021-40906 or the next vulnerability affects your stack