CVE catalog
CVE-2021-40906
UBUNTU-CVE-2021-40906
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.99% · Oct 25, 2026
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | check-mk | 18.04 | 1.2.8p16-1ubuntu0.1 | vulnerable |
| Ubuntu | check-mk | 18.04 | 1.2.8p16-1ubuntu0.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Ubuntu | check-mk | deb | 18.04 | 1.2.8p16-1ubuntu0.2 | Not reported | UBUNTU-CVE-2021-40906 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: