Read the docs
TI-2017-08509 Aliases CVE-2017-11507GHSA-gg6p-3mxx-fqcj

Cross-site scripting in Tenable Check_MK

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.

Why it matters now

EPSS 0.01029 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Check_MK (Tenable): 1.4.0p9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TenableCheck_MK1.2.8x prior to 1. 2.8p25; 1.4.0x to before 1.4.0p91.4.0p9Patch availableCNA
  • Check_MK VendorTenable Affected 1.2.8x prior to 1. 2.8p25; 1.4.0x to before 1.4.0p9 Fixed in 1.4.0p9 Patch available CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:a:check_mk_project:check_mk:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b1:*:*:*:*:*:*1.2.8 b1VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b10:*:*:*:*:*:*1.2.8 b10VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b11:*:*:*:*:*:*1.2.8 b11VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b2:*:*:*:*:*:*1.2.8 b2VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b3:*:*:*:*:*:*1.2.8 b3VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b4:*:*:*:*:*:*1.2.8 b4VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b5:*:*:*:*:*:*1.2.8 b5VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b6:*:*:*:*:*:*1.2.8 b6VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b7:*:*:*:*:*:*1.2.8 b7VulnerableCheck Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b1:*:*:*:*:*:* Versions 1.2.8 b1 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b10:*:*:*:*:*:* Versions 1.2.8 b10 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b11:*:*:*:*:*:* Versions 1.2.8 b11 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b2:*:*:*:*:*:* Versions 1.2.8 b2 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b3:*:*:*:*:*:* Versions 1.2.8 b3 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b4:*:*:*:*:*:* Versions 1.2.8 b4 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b5:*:*:*:*:*:* Versions 1.2.8 b5 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b6:*:*:*:*:*:* Versions 1.2.8 b6 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b7:*:*:*:*:*:* Versions 1.2.8 b7 Vulnerable ·Check Mk Project
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b8:*:*:*:*:*:*1.2.8 b8VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:b9:*:*:*:*:*:*1.2.8 b9VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p1:*:*:*:*:*:*1.2.8 p1VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p10:*:*:*:*:*:*1.2.8 p10VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p11:*:*:*:*:*:*1.2.8 p11VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p12:*:*:*:*:*:*1.2.8 p12VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p13:*:*:*:*:*:*1.2.8 p13VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p14:*:*:*:*:*:*1.2.8 p14VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p15:*:*:*:*:*:*1.2.8 p15VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p16:*:*:*:*:*:*1.2.8 p16VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p17:*:*:*:*:*:*1.2.8 p17VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p18:*:*:*:*:*:*1.2.8 p18VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p19:*:*:*:*:*:*1.2.8 p19VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p2:*:*:*:*:*:*1.2.8 p2VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p20:*:*:*:*:*:*1.2.8 p20VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p21:*:*:*:*:*:*1.2.8 p21VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p22:*:*:*:*:*:*1.2.8 p22VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p23:*:*:*:*:*:*1.2.8 p23VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p24:*:*:*:*:*:*1.2.8 p24VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p25:*:*:*:*:*:*1.2.8 p25VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p3:*:*:*:*:*:*1.2.8 p3VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p4:*:*:*:*:*:*1.2.8 p4VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p5:*:*:*:*:*:*1.2.8 p5VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p6:*:*:*:*:*:*1.2.8 p6VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p7:*:*:*:*:*:*1.2.8 p7VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p8:*:*:*:*:*:*1.2.8 p8VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.2.8:p9:*:*:*:*:*:*1.2.8 p9VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b1:*:*:*:*:*:*1.4.0 b1VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b2:*:*:*:*:*:*1.4.0 b2VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b3:*:*:*:*:*:*1.4.0 b3VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b4:*:*:*:*:*:*1.4.0 b4VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b5:*:*:*:*:*:*1.4.0 b5VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b6:*:*:*:*:*:*1.4.0 b6VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b7:*:*:*:*:*:*1.4.0 b7VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b8:*:*:*:*:*:*1.4.0 b8VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:b9:*:*:*:*:*:*1.4.0 b9VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:*1.4.0 p1VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:*1.4.0 p2VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:*1.4.0 p3VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:*1.4.0 p4VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:*1.4.0 p5VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p6:*:*:*:*:*:*1.4.0 p6VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p7:*:*:*:*:*:*1.4.0 p7VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p8:*:*:*:*:*:*1.4.0 p8VulnerableCheck Mk Project
cpe:2.3:a:check_mk_project:check_mk:1.4.0:p9:*:*:*:*:*:*1.4.0 p9VulnerableCheck Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b8:*:*:*:*:*:* Versions 1.2.8 b8 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:b9:*:*:*:*:*:* Versions 1.2.8 b9 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p1:*:*:*:*:*:* Versions 1.2.8 p1 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p10:*:*:*:*:*:* Versions 1.2.8 p10 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p11:*:*:*:*:*:* Versions 1.2.8 p11 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p12:*:*:*:*:*:* Versions 1.2.8 p12 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p13:*:*:*:*:*:* Versions 1.2.8 p13 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p14:*:*:*:*:*:* Versions 1.2.8 p14 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p15:*:*:*:*:*:* Versions 1.2.8 p15 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p16:*:*:*:*:*:* Versions 1.2.8 p16 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p17:*:*:*:*:*:* Versions 1.2.8 p17 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p18:*:*:*:*:*:* Versions 1.2.8 p18 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p19:*:*:*:*:*:* Versions 1.2.8 p19 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p2:*:*:*:*:*:* Versions 1.2.8 p2 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p20:*:*:*:*:*:* Versions 1.2.8 p20 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p21:*:*:*:*:*:* Versions 1.2.8 p21 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p22:*:*:*:*:*:* Versions 1.2.8 p22 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p23:*:*:*:*:*:* Versions 1.2.8 p23 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p24:*:*:*:*:*:* Versions 1.2.8 p24 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p25:*:*:*:*:*:* Versions 1.2.8 p25 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p3:*:*:*:*:*:* Versions 1.2.8 p3 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p4:*:*:*:*:*:* Versions 1.2.8 p4 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p5:*:*:*:*:*:* Versions 1.2.8 p5 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p6:*:*:*:*:*:* Versions 1.2.8 p6 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p7:*:*:*:*:*:* Versions 1.2.8 p7 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p8:*:*:*:*:*:* Versions 1.2.8 p8 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.2.8:p9:*:*:*:*:*:* Versions 1.2.8 p9 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b1:*:*:*:*:*:* Versions 1.4.0 b1 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b2:*:*:*:*:*:* Versions 1.4.0 b2 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b3:*:*:*:*:*:* Versions 1.4.0 b3 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b4:*:*:*:*:*:* Versions 1.4.0 b4 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b5:*:*:*:*:*:* Versions 1.4.0 b5 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b6:*:*:*:*:*:* Versions 1.4.0 b6 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b7:*:*:*:*:*:* Versions 1.4.0 b7 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b8:*:*:*:*:*:* Versions 1.4.0 b8 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:b9:*:*:*:*:*:* Versions 1.4.0 b9 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p1:*:*:*:*:*:* Versions 1.4.0 p1 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p2:*:*:*:*:*:* Versions 1.4.0 p2 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p3:*:*:*:*:*:* Versions 1.4.0 p3 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p4:*:*:*:*:*:* Versions 1.4.0 p4 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p5:*:*:*:*:*:* Versions 1.4.0 p5 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p6:*:*:*:*:*:* Versions 1.4.0 p6 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p7:*:*:*:*:*:* Versions 1.4.0 p7 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p8:*:*:*:*:*:* Versions 1.4.0 p8 Vulnerable ·Check Mk Project
  • cpe:2.3:a:check_mk_project:check_mk:1.4.0:p9:*:*:*:*:*:* Versions 1.4.0 p9 Vulnerable ·Check Mk Project

Remediation

  • Fix · CNA Check_MK (Tenable) Fixed in 1.4.0p9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11507
  2. 2026-10-03 Alias added: GHSA-gg6p-3mxx-fqcj

References

Exploit 1

Advisory 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
  • TI-2021-20274 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences