PT-2017-12060 · Mathias Kettner · Checkmk

Publicado 2017-12-11 · Atualizado 2017-12-26 · CVE-2017-11507

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Check MK versions 1.2.8x prior to 1.2.8p25 Check MK versions 1.4.0x prior to 1.4.0p9

Description A cross site scripting (XSS) issue exists, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output format parameter and the username parameter of failed HTTP basic authentication attempts. This is possible because the username parameter is returned unencoded in an internal server error page.

Recommendations For Check MK versions 1.2.8x prior to 1.2.8p25, update to version 1.2.8p25 or later. For Check MK versions 1.4.0x prior to 1.4.0p9, update to version 1.4.0p9 or later. As a temporary workaround, consider restricting access to the output format parameter and ensuring proper encoding of the username parameter in error pages to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-11507

Produtos afetados

Checkmk

Referências · 7

• 🔥 https://tenable.com/security/research/tra-2017-20 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11507 · Nota de Segurança
• http://mathias-kettner.com/check_mk_werks.php?werk_id=7661 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-11507 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11507 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11507 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-11507 · Aviso do Fabricante