SecuritySpace - CVE-2021-40906

Vulnerability Search		Search 324607 CVE descriptions and 146377 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2021-40906

Description: CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.

Test IDs: 1.3.6.1.4.1.25623.1.0.147859

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2021-40906
http://checkmk.com
https://github.com/Edgarloyola/CVE-2021-40906

CVE ID:	CVE-2021-40906
Description:	CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.
Test IDs:	1.3.6.1.4.1.25623.1.0.147859
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2021-40906 http://checkmk.com https://github.com/Edgarloyola/CVE-2021-40906