{"id":"CVE-2017-11507","details":"A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.","modified":"2026-10-24T10:30:54.537355388Z","published":"2017-12-11T16:29:00.203Z","database_specific":{},"references":[{"type":"ADVISORY","url":"http://mathias-kettner.com/check_mk_werks.php?werk_id=7661"},{"type":"EVIDENCE","url":"https://www.tenable.com/security/research/tra-2017-20"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/Checkmk/checkmk","events":[{"introduced":"43a36d6f930612dddca5f389212004b50c663e30"},{"last_affected":"2c508a7e8192d1335d8ea4b90ad9bad8f842a607"}],"database_specific":{"extracted_events":[{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:*:*:*:*:*:*:*","range":[{"introduced":"1.2.8"},{"last_affected":"1.2.8"}]},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b1:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b1"},{"last_affected":"1.2.8-b1"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p1"},{"last_affected":"1.2.8-p1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p1:*:*:*:*:*:*"},{"range":[{"introduced":"1.2.8-b10"},{"last_affected":"1.2.8-b10"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b10:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p10:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p10"},{"last_affected":"1.2.8-p10"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b11:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b11"},{"last_affected":"1.2.8-b11"}]},{"range":[{"introduced":"1.2.8-p11"},{"last_affected":"1.2.8-p11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p11:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b2:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b2"},{"last_affected":"1.2.8-b2"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p2"},{"last_affected":"1.2.8-p2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p2:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b3:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b3"},{"last_affected":"1.2.8-b3"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p3"},{"last_affected":"1.2.8-p3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p3:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b4:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b4"},{"last_affected":"1.2.8-b4"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p4:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p4"},{"last_affected":"1.2.8-p4"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b5:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b5"},{"last_affected":"1.2.8-b5"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p5:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p5"},{"last_affected":"1.2.8-p5"}]},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b6:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b6"},{"last_affected":"1.2.8-b6"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p6"},{"last_affected":"1.2.8-p6"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p6:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b7:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b7"},{"last_affected":"1.2.8-b7"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p7:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p7"},{"last_affected":"1.2.8-p7"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-b8"},{"last_affected":"1.2.8-b8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b8:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p8:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p8"},{"last_affected":"1.2.8-p8"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:b9:*:*:*:*:*:*","range":[{"introduced":"1.2.8-b9"},{"last_affected":"1.2.8-b9"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p9:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p9"},{"last_affected":"1.2.8-p9"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p12:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p12"},{"last_affected":"1.2.8-p12"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p13"},{"last_affected":"1.2.8-p13"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p13:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p14:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p14"},{"last_affected":"1.2.8-p14"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p15:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p15"},{"last_affected":"1.2.8-p15"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p16:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p16"},{"last_affected":"1.2.8-p16"}]},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p17:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p17"},{"last_affected":"1.2.8-p17"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p18"},{"last_affected":"1.2.8-p18"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p18:*:*:*:*:*:*"},{"range":[{"introduced":"1.2.8-p19"},{"last_affected":"1.2.8-p19"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p19:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p20:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p20"},{"last_affected":"1.2.8-p20"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p21"},{"last_affected":"1.2.8-p21"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p21:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p22:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p22"},{"last_affected":"1.2.8-p22"}]},{"range":[{"introduced":"1.2.8-p23"},{"last_affected":"1.2.8-p23"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p23:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p24:*:*:*:*:*:*","range":[{"introduced":"1.2.8-p24"},{"last_affected":"1.2.8-p24"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.2.8-p25"},{"last_affected":"1.2.8-p25"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.2.8:p25:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*","range":[{"introduced":"1.4.0"},{"last_affected":"1.4.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.4.0-b1"},{"last_affected":"1.4.0-b1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b1:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*","range":[{"introduced":"1.4.0-p1"},{"last_affected":"1.4.0-p1"}]},{"range":[{"introduced":"1.4.0-b2"},{"last_affected":"1.4.0-b2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b2:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*","range":[{"introduced":"1.4.0-p2"},{"last_affected":"1.4.0-p2"}]},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b3:*:*:*:*:*:*","range":[{"introduced":"1.4.0-b3"},{"last_affected":"1.4.0-b3"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*","range":[{"introduced":"1.4.0-p3"},{"last_affected":"1.4.0-p3"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b4:*:*:*:*:*:*","range":[{"introduced":"1.4.0-b4"},{"last_affected":"1.4.0-b4"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*","range":[{"introduced":"1.4.0-p4"},{"last_affected":"1.4.0-p4"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b5:*:*:*:*:*:*","range":[{"introduced":"1.4.0-b5"},{"last_affected":"1.4.0-b5"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.4.0-p5"},{"last_affected":"1.4.0-p5"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*"},{"range":[{"introduced":"1.4.0-b6"},{"last_affected":"1.4.0-b6"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b6:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p6:*:*:*:*:*:*","range":[{"introduced":"1.4.0-p6"},{"last_affected":"1.4.0-p6"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b7:*:*:*:*:*:*","range":[{"introduced":"1.4.0-b7"},{"last_affected":"1.4.0-b7"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p7:*:*:*:*:*:*","range":[{"introduced":"1.4.0-p7"},{"last_affected":"1.4.0-p7"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b8:*:*:*:*:*:*","range":[{"introduced":"1.4.0-b8"},{"last_affected":"1.4.0-b8"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.4.0-p8"},{"last_affected":"1.4.0-p8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p8:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:b9:*:*:*:*:*:*","range":[{"introduced":"1.4.0-b9"},{"last_affected":"1.4.0-b9"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.4.0-p9"},{"last_affected":"1.4.0-p9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:check_mk_project:check_mk:1.4.0:p9:*:*:*:*:*:*"}]}}],"versions":["1.2.8","1.2.8-b1","1.2.8-b10","1.2.8-b11","1.2.8-b2","1.2.8-b3","1.2.8-b4","1.2.8-b5","1.2.8-b6","1.2.8-b7","1.2.8-b8","1.2.8-b9","1.2.8-p12","1.2.8-p13","1.2.8-p14","1.2.8-p15","1.2.8-p16","1.2.8-p17","1.2.8-p18","1.2.8-p19","1.2.8-p20","1.2.8-p21","1.2.8-p22","1.2.8-p23","1.2.8-p24","1.2.8-p25","1.4.0","1.4.0-b1","1.4.0-b2","1.4.0-b3","1.4.0-b4","1.4.0-b5","1.4.0-b6","1.4.0-b7","1.4.0-b8","1.4.0-b9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11507.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}