6.1

CVE-2021-40906: checkmk Cross-site Scripting

CVSS: 6.1v3.1MediumModified
AliasesUBUNTU-CVE-2021-40906
Published 25-03-2022Last modified 09-07-2026
Open JSON

Vulnerability summary

CVE-2021-40906 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in checkmk. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
0.99%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
USN-5527-1

Timeline

  1. 25-03-2022
    PublishedVulnerability first disclosed.
  2. 09-07-2026
    Last modifiedVulnerability information updated.

Description

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

0.99%

Chance of exploitation in the next 30 days

Percentile

62%

Versus all other CVEs

30-day change

0.00 pp

From 0.99% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Checkmk1 product
  • checkmk≥ 1.5.0, < 1.6.0 | 1.6.0 | 1.6.0:b1 | 1.6.0:b10 | 1.6.0:b12 | 1.6.0:b3 | 1.6.0:b4 | 1.6.0:b5 | 1.6.0:b9 | 1.6.0:p1 | 1.6.0:p10 | 1.6.0:p11 | 1.6.0:p12 | 1.6.0:p13 | 1.6.0:p14 | 1.6.0:p15 | 1.6.0:p16 | 1.6.0:p19 | 1.6.0:p2 | 1.6.0:p20 | 1.6.0:p21 | 1.6.0:p22 | 1.6.0:p23 | 1.6.0:p24 | 1.6.0:p25 | 1.6.0:p3 | 1.6.0:p4 | 1.6.0:p5 | 1.6.0:p6 | 1.6.0:p7 | 1.6.0:p8 | 1.6.0:p9
Tribe291 product
  • checkmk1.6.0b10 | 1.6.0b11 | 1.6.0p10 | 1.6.0p17 | 1.6.0p18
Ubuntu1 product
  • check-mk< 1.2.8p16-1ubuntu0.2

3 vendors · 3 products

References

5 links