| Package | Affected versions | Patched versions |
|---|---|---|
| check mk | = 1.2.8= 1.4.0 |
A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free