cpe:/a:check_mk_project:check_mk:1.4.0 cpe:/a:check_mk_project:check_mk:1.4.0:p1 cpe:/a:check_mk_project:check_mk:1.4.0:p2 cpe:/a:check_mk_project:check_mk:1.4.0:p3 cpe:/a:check_mk_project:check_mk:1.4.0:p4 cpe:/a:check_mk_project:check_mk:1.4.0:p5 CVE-2017-9781 2017-06-21T14:29:00.387-04:00 2019-04-22T12:55:36.150-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2019-04-22T12:45:11.043-04:00 CONFIRM http://git.mathias-kettner.de/git/?p=check_mk.git;a=blob;f=.werks/4757;hb=c248f0b6ff7b15ced9f07a3df8a80fad656ea5b1 MISC https://www.tenable.com/security/research/tra-2017-21 A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.