CVE-2017-11507

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-11507
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11507.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-11507
Downstream
Published
2017-12-11T16:29:00Z
Modified
2026-08-27T08:15:05Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

References

Affected packages

Git / github.com/Checkmk/checkmk

Affected ranges

Type
GIT
Repo
https://github.com/Checkmk/checkmk
Events
Introduced
43a36d6f930612dddca5f389212004b50c663e30
Last Affected
2c508a7e8192d1335d8ea4b90ad9bad8f842a607
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b1:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p1:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b10:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p10:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b11:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p11:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b2:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p2:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b3:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p3:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b4:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p4:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b5:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p5:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b6:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p6:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b7:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p7:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b8:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p8:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:b9:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p9:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p12:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p13:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p14:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p15:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p16:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p17:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p18:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p19:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p20:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p21:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p22:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p23:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p24:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.2.8:p25:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b1:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b2:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b3:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b4:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b5:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b6:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p6:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b7:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p7:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b8:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p8:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:b9:*:*:*:*:*:*",
        "cpe:2.3:a:check_mk_project:check_mk:1.4.0:p9:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.2.8"
        },
        {
            "last_affected": "1.2.8"
        },
        {
            "introduced": "1.2.8-b1"
        },
        {
            "last_affected": "1.2.8-b1"
        },
        {
            "introduced": "1.2.8-p1"
        },
        {
            "last_affected": "1.2.8-p1"
        },
        {
            "introduced": "1.2.8-b10"
        },
        {
            "last_affected": "1.2.8-b10"
        },
        {
            "introduced": "1.2.8-p10"
        },
        {
            "last_affected": "1.2.8-p10"
        },
        {
            "introduced": "1.2.8-b11"
        },
        {
            "last_affected": "1.2.8-b11"
        },
        {
            "introduced": "1.2.8-p11"
        },
        {
            "last_affected": "1.2.8-p11"
        },
        {
            "introduced": "1.2.8-b2"
        },
        {
            "last_affected": "1.2.8-b2"
        },
        {
            "introduced": "1.2.8-p2"
        },
        {
            "last_affected": "1.2.8-p2"
        },
        {
            "introduced": "1.2.8-b3"
        },
        {
            "last_affected": "1.2.8-b3"
        },
        {
            "introduced": "1.2.8-p3"
        },
        {
            "last_affected": "1.2.8-p3"
        },
        {
            "introduced": "1.2.8-b4"
        },
        {
            "last_affected": "1.2.8-b4"
        },
        {
            "introduced": "1.2.8-p4"
        },
        {
            "last_affected": "1.2.8-p4"
        },
        {
            "introduced": "1.2.8-b5"
        },
        {
            "last_affected": "1.2.8-b5"
        },
        {
            "introduced": "1.2.8-p5"
        },
        {
            "last_affected": "1.2.8-p5"
        },
        {
            "introduced": "1.2.8-b6"
        },
        {
            "last_affected": "1.2.8-b6"
        },
        {
            "introduced": "1.2.8-p6"
        },
        {
            "last_affected": "1.2.8-p6"
        },
        {
            "introduced": "1.2.8-b7"
        },
        {
            "last_affected": "1.2.8-b7"
        },
        {
            "introduced": "1.2.8-p7"
        },
        {
            "last_affected": "1.2.8-p7"
        },
        {
            "introduced": "1.2.8-b8"
        },
        {
            "last_affected": "1.2.8-b8"
        },
        {
            "introduced": "1.2.8-p8"
        },
        {
            "last_affected": "1.2.8-p8"
        },
        {
            "introduced": "1.2.8-b9"
        },
        {
            "last_affected": "1.2.8-b9"
        },
        {
            "introduced": "1.2.8-p9"
        },
        {
            "last_affected": "1.2.8-p9"
        },
        {
            "introduced": "1.2.8-p12"
        },
        {
            "last_affected": "1.2.8-p12"
        },
        {
            "introduced": "1.2.8-p13"
        },
        {
            "last_affected": "1.2.8-p13"
        },
        {
            "introduced": "1.2.8-p14"
        },
        {
            "last_affected": "1.2.8-p14"
        },
        {
            "introduced": "1.2.8-p15"
        },
        {
            "last_affected": "1.2.8-p15"
        },
        {
            "introduced": "1.2.8-p16"
        },
        {
            "last_affected": "1.2.8-p16"
        },
        {
            "introduced": "1.2.8-p17"
        },
        {
            "last_affected": "1.2.8-p17"
        },
        {
            "introduced": "1.2.8-p18"
        },
        {
            "last_affected": "1.2.8-p18"
        },
        {
            "introduced": "1.2.8-p19"
        },
        {
            "last_affected": "1.2.8-p19"
        },
        {
            "introduced": "1.2.8-p20"
        },
        {
            "last_affected": "1.2.8-p20"
        },
        {
            "introduced": "1.2.8-p21"
        },
        {
            "last_affected": "1.2.8-p21"
        },
        {
            "introduced": "1.2.8-p22"
        },
        {
            "last_affected": "1.2.8-p22"
        },
        {
            "introduced": "1.2.8-p23"
        },
        {
            "last_affected": "1.2.8-p23"
        },
        {
            "introduced": "1.2.8-p24"
        },
        {
            "last_affected": "1.2.8-p24"
        },
        {
            "introduced": "1.2.8-p25"
        },
        {
            "last_affected": "1.2.8-p25"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        },
        {
            "introduced": "1.4.0-b1"
        },
        {
            "last_affected": "1.4.0-b1"
        },
        {
            "introduced": "1.4.0-p1"
        },
        {
            "last_affected": "1.4.0-p1"
        },
        {
            "introduced": "1.4.0-b2"
        },
        {
            "last_affected": "1.4.0-b2"
        },
        {
            "introduced": "1.4.0-p2"
        },
        {
            "last_affected": "1.4.0-p2"
        },
        {
            "introduced": "1.4.0-b3"
        },
        {
            "last_affected": "1.4.0-b3"
        },
        {
            "introduced": "1.4.0-p3"
        },
        {
            "last_affected": "1.4.0-p3"
        },
        {
            "introduced": "1.4.0-b4"
        },
        {
            "last_affected": "1.4.0-b4"
        },
        {
            "introduced": "1.4.0-p4"
        },
        {
            "last_affected": "1.4.0-p4"
        },
        {
            "introduced": "1.4.0-b5"
        },
        {
            "last_affected": "1.4.0-b5"
        },
        {
            "introduced": "1.4.0-p5"
        },
        {
            "last_affected": "1.4.0-p5"
        },
        {
            "introduced": "1.4.0-b6"
        },
        {
            "last_affected": "1.4.0-b6"
        },
        {
            "introduced": "1.4.0-p6"
        },
        {
            "last_affected": "1.4.0-p6"
        },
        {
            "introduced": "1.4.0-b7"
        },
        {
            "last_affected": "1.4.0-b7"
        },
        {
            "introduced": "1.4.0-p7"
        },
        {
            "last_affected": "1.4.0-p7"
        },
        {
            "introduced": "1.4.0-b8"
        },
        {
            "last_affected": "1.4.0-b8"
        },
        {
            "introduced": "1.4.0-p8"
        },
        {
            "last_affected": "1.4.0-p8"
        },
        {
            "introduced": "1.4.0-b9"
        },
        {
            "last_affected": "1.4.0-b9"
        },
        {
            "introduced": "1.4.0-p9"
        },
        {
            "last_affected": "1.4.0-p9"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*
1.2.8
1.2.8-b1
1.2.8-b10
1.2.8-b11
1.2.8-b2
1.2.8-b3
1.2.8-b4
1.2.8-b5
1.2.8-b6
1.2.8-b7
1.2.8-b8
1.2.8-b9
1.2.8-p12
1.2.8-p13
1.2.8-p14
1.2.8-p15
1.2.8-p16
1.2.8-p17
1.2.8-p18
1.2.8-p19
1.2.8-p20
1.2.8-p21
1.2.8-p22
1.2.8-p23
1.2.8-p24
1.2.8-p25
1.4.0
1.4.0-b1
1.4.0-b2
1.4.0-b3
1.4.0-b4
1.4.0-b5
1.4.0-b6
1.4.0-b7
1.4.0-b8
1.4.0-b9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11507.json"