CVE-2021-40906
Severity Score
6.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.
El software CheckMK Raw Edition (versiones 1.5.0 a 1.6.0) no sanea la entrada de un parámetro de servicio web que está en una zona no autenticada. Este ataque de tipo XSS reflejado permite a un atacante abrir una puerta trasera en el dispositivo con contenido HTML e interpretado por el navegador (como JavaScript u otros scripts del lado del cliente) o robar las cookies de sesión de un usuario que se haya autenticado previamente por medio de un ataque de tipo man in the middle. Una explotación con éxito requiere el acceso al recurso del servicio web sin autenticación
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-09-13 CVE Reserved
- 2022-03-25 CVE Published
- 2023-10-16 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://checkmk.com | Product |
| URL | Date | SRC |
|---|---|---|
| https://github.com/Edgarloyola/CVE-2021-40906 | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | >= 1.5.0 < 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version " >= 1.5.0 < 1.6.0" | - |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | - |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b1 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b10 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b12 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b3 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b4 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b5 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | b9 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p1 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p10 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p11 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p12 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p13 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p14 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p15 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p16 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p19 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p2 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p20 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p21 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p22 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p23 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p24 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p25 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p3 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p4 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p5 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p6 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p7 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p8 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0" | p9 |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0b10 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0b10" | - |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0b11 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0b11" | - |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0p10 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0p10" | - |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0p17 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0p17" | - |
Affected
| ||||||
| Tribe29 Search vendor "Tribe29" | Checkmk Search vendor "Tribe29" for product "Checkmk" | 1.6.0p18 Search vendor "Tribe29" for product "Checkmk" and version "1.6.0p18" | - |
Affected
| ||||||