CVE-2021-40906 Cross-site scripting in n/a

What is CVE-2021-40906?

CVE-2021-40906 is a medium-severity cross-site scripting vulnerability in Checkmk Checkmk, published on 25 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.

Weakness: CWE-79

Which versions are affected by CVE-2021-40906?

It affects 2 products.

Products include Checkmk Checkmk, Tribe29 Checkmk.

How do I fix CVE-2021-40906?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-40906 being exploited?

There is no known exploitation of CVE-2021-40906 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Checkmk Checkmk

• CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root Critical 9.3
• CVE-2024-8606 Fix 2FA bypass via RestAPI Critical 9.2
• CVE-2022-46836 PHP code injection in watolib Critical 9.1
• CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent High 8.8
• CVE-2024-28827 Privilege escalation in Windows agent High 8.8

All Checkmk Checkmk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jv73-q4rg-p7qh, UBUNTU-CVE-2021-40906.