VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 21, 2017· Updated May 13, 2026

CVE-2017-9781

CVE-2017-9781

Description

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.

Affected products

6
  • Check Mk Project/Check Mk6 versions
    cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.