VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 21, 2017· Updated Jun 17, 2026

CVE-2017-9781

CVE-2017-9781

Description

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Check Mk Project/Check Mk7 versions
    cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*
    • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*
    • (no CPE)range: >=1.4.0x, <1.4.0p6

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.