{"id":"CVE-2017-11507","details":"A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.","modified":"2026-08-27T08:15:05.552276Z","published":"2017-12-11T16:29:00.203Z","references":[{"type":"ADVISORY","url":"http://mathias-kettner.com/check_mk_werks.php?werk_id=7661"},{"type":"EVIDENCE","url":"https://www.tenable.com/security/research/tra-2017-20"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/Checkmk/checkmk","events":[{"introduced":"43a36d6f930612dddca5f389212004b50c663e30"},{"last_affected":"2c508a7e8192d1335d8ea4b90ad9bad8f842a607"}],"database_specific":{"cpe":["cpe:2.3:a:check_mk_project:check_mk:1.2.8:*:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b1:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p1:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b10:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p10:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b11:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p11:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b2:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p2:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b3:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p3:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b4:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p4:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b5:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p5:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b6:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p6:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b7:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p7:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b8:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p8:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:b9:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p9:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p12:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p13:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p14:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p15:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p16:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p17:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p18:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p19:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p20:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p21:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p22:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p23:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p24:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.2.8:p25:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b1:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b2:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b3:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b4:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b5:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b6:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p6:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b7:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p7:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b8:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p8:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:b9:*:*:*:*:*:*","cpe:2.3:a:check_mk_project:check_mk:1.4.0:p9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.2.8"},{"last_affected":"1.2.8"},{"introduced":"1.2.8-b1"},{"last_affected":"1.2.8-b1"},{"introduced":"1.2.8-p1"},{"last_affected":"1.2.8-p1"},{"introduced":"1.2.8-b10"},{"last_affected":"1.2.8-b10"},{"introduced":"1.2.8-p10"},{"last_affected":"1.2.8-p10"},{"introduced":"1.2.8-b11"},{"last_affected":"1.2.8-b11"},{"introduced":"1.2.8-p11"},{"last_affected":"1.2.8-p11"},{"introduced":"1.2.8-b2"},{"last_affected":"1.2.8-b2"},{"introduced":"1.2.8-p2"},{"last_affected":"1.2.8-p2"},{"introduced":"1.2.8-b3"},{"last_affected":"1.2.8-b3"},{"introduced":"1.2.8-p3"},{"last_affected":"1.2.8-p3"},{"introduced":"1.2.8-b4"},{"last_affected":"1.2.8-b4"},{"introduced":"1.2.8-p4"},{"last_affected":"1.2.8-p4"},{"introduced":"1.2.8-b5"},{"last_affected":"1.2.8-b5"},{"introduced":"1.2.8-p5"},{"last_affected":"1.2.8-p5"},{"introduced":"1.2.8-b6"},{"last_affected":"1.2.8-b6"},{"introduced":"1.2.8-p6"},{"last_affected":"1.2.8-p6"},{"introduced":"1.2.8-b7"},{"last_affected":"1.2.8-b7"},{"introduced":"1.2.8-p7"},{"last_affected":"1.2.8-p7"},{"introduced":"1.2.8-b8"},{"last_affected":"1.2.8-b8"},{"introduced":"1.2.8-p8"},{"last_affected":"1.2.8-p8"},{"introduced":"1.2.8-b9"},{"last_affected":"1.2.8-b9"},{"introduced":"1.2.8-p9"},{"last_affected":"1.2.8-p9"},{"introduced":"1.2.8-p12"},{"last_affected":"1.2.8-p12"},{"introduced":"1.2.8-p13"},{"last_affected":"1.2.8-p13"},{"introduced":"1.2.8-p14"},{"last_affected":"1.2.8-p14"},{"introduced":"1.2.8-p15"},{"last_affected":"1.2.8-p15"},{"introduced":"1.2.8-p16"},{"last_affected":"1.2.8-p16"},{"introduced":"1.2.8-p17"},{"last_affected":"1.2.8-p17"},{"introduced":"1.2.8-p18"},{"last_affected":"1.2.8-p18"},{"introduced":"1.2.8-p19"},{"last_affected":"1.2.8-p19"},{"introduced":"1.2.8-p20"},{"last_affected":"1.2.8-p20"},{"introduced":"1.2.8-p21"},{"last_affected":"1.2.8-p21"},{"introduced":"1.2.8-p22"},{"last_affected":"1.2.8-p22"},{"introduced":"1.2.8-p23"},{"last_affected":"1.2.8-p23"},{"introduced":"1.2.8-p24"},{"last_affected":"1.2.8-p24"},{"introduced":"1.2.8-p25"},{"last_affected":"1.2.8-p25"},{"introduced":"1.4.0"},{"last_affected":"1.4.0"},{"introduced":"1.4.0-b1"},{"last_affected":"1.4.0-b1"},{"introduced":"1.4.0-p1"},{"last_affected":"1.4.0-p1"},{"introduced":"1.4.0-b2"},{"last_affected":"1.4.0-b2"},{"introduced":"1.4.0-p2"},{"last_affected":"1.4.0-p2"},{"introduced":"1.4.0-b3"},{"last_affected":"1.4.0-b3"},{"introduced":"1.4.0-p3"},{"last_affected":"1.4.0-p3"},{"introduced":"1.4.0-b4"},{"last_affected":"1.4.0-b4"},{"introduced":"1.4.0-p4"},{"last_affected":"1.4.0-p4"},{"introduced":"1.4.0-b5"},{"last_affected":"1.4.0-b5"},{"introduced":"1.4.0-p5"},{"last_affected":"1.4.0-p5"},{"introduced":"1.4.0-b6"},{"last_affected":"1.4.0-b6"},{"introduced":"1.4.0-p6"},{"last_affected":"1.4.0-p6"},{"introduced":"1.4.0-b7"},{"last_affected":"1.4.0-b7"},{"introduced":"1.4.0-p7"},{"last_affected":"1.4.0-p7"},{"introduced":"1.4.0-b8"},{"last_affected":"1.4.0-b8"},{"introduced":"1.4.0-p8"},{"last_affected":"1.4.0-p8"},{"introduced":"1.4.0-b9"},{"last_affected":"1.4.0-b9"},{"introduced":"1.4.0-p9"},{"last_affected":"1.4.0-p9"}],"source":"CPE_STRING"}}],"versions":["1.2.8","1.2.8-b1","1.2.8-b10","1.2.8-b11","1.2.8-b2","1.2.8-b3","1.2.8-b4","1.2.8-b5","1.2.8-b6","1.2.8-b7","1.2.8-b8","1.2.8-b9","1.2.8-p12","1.2.8-p13","1.2.8-p14","1.2.8-p15","1.2.8-p16","1.2.8-p17","1.2.8-p18","1.2.8-p19","1.2.8-p20","1.2.8-p21","1.2.8-p22","1.2.8-p23","1.2.8-p24","1.2.8-p25","1.4.0","1.4.0-b1","1.4.0-b2","1.4.0-b3","1.4.0-b4","1.4.0-b5","1.4.0-b6","1.4.0-b7","1.4.0-b8","1.4.0-b9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11507.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}