CVE-2017-14955
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because...
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
- Record
CVE-2017-14955- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-362
- Updated
- 2026-11-02
CVE List No score
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
- Record
CVE-2017-14955- Updated
- 2026-11-02
EUVDEUVD-2017-6431 No score
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
- Record
EUVD-2017-6431- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8qhg-c9h2-g6rj
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because...
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
- Record
GHSA-8qhg-c9h2-g6rj- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
- Record
CVE-2017-14955- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-14955
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
- Record
UBUNTU-CVE-2017-14955- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-5527-1 No score
check-mk vulnerabilities
It was discovered that Checkmk incorrectly handled authentication. An attacker could possibly use this issue to cause a race condition leading to information disclosure. (CVE-2017-14955)
It was discovered that Checkmk incorrectly handled certain inputs. An attacker could use these cross-site scripting issues to inject arbitrary html or javascript code to obtain sensitive information including user information, session cookies and valid credentials. (CVE-2017-9781, CVE-2021-36563, CVE-2021-40906, CVE-2022-24565)
- Record
USN-5527-1- Updated
- 2026-11-02
OSVUSN-5527-2 No score
check-mk vulnerabilities
USN-5527-1 fixed vulnerabilities in Checkmk. This update provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Checkmk incorrectly handled authentication. An attacker could possibly use this issue to cause a race condition leading to information disclosure. (CVE-2017-14955)
It was discovered that Checkmk incorrectly handled certain inputs. An attacker could use these cross-site scripting issues to inject arbitrary html or javascript code to obtain sensitive information including user information, session cookies and valid credentials. (CVE-2017-9781, CVE-2021-36563, CVE-2021-40906, CVE-2022-24565)
- Record
USN-5527-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
check-mkUbuntu:Pro:16.04:LTS |
before 1.2.6p12-1ubuntu0.16.04.1+esm1, plus listed versions 1.2.6p5-11.2.6p12-11.2.6p12-1ubuntu0.16.04.1 |
1.2.6p12-1ubuntu0.16.04.1+esm1 |
check-mkUbuntu:18.04:LTS |
before 1.2.8p16-1ubuntu0.2, plus listed versions 1.2.8p16-1ubuntu0.1 |
1.2.8p16-1ubuntu0.2 |
check-mkUbuntu:18.04:LTS From an advisory covering 5 CVEs |
before 1.2.8p16-1ubuntu0.2, plus listed versions 1.2.8p16-1ubuntu0.1 |
1.2.8p16-1ubuntu0.2 |
check-mkUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 1.2.6p12-1ubuntu0.16.04.1+esm1, plus listed versions 1.2.6p5-11.2.6p12-11.2.6p12-1ubuntu0.16.04.1 |
1.2.6p12-1ubuntu0.16.04.1+esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Check_MK 1.2.8p25 - Information Disclosure | 2017-10-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14955 is a medium vulnerability (CVSS 5.9) in Checkmk, published October 1, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.1%, the 96th percentile. Fixed in check-mk 1.2.6p12-1ubuntu0.16.04.1+esm1.
References
exploit-db.com/exploits/43021
mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8
mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes
nvd.nist.gov/vuln/detail/CVE-2017-14955
github.com/advisories/GHSA-8qhg-c9h2-g6rj
ubuntu.com/security/CVE-2017-14955
Show 8 moreShow less
git.mathias-kettner.de/git?p=check_mk.git;a=commitdiff;h=a4a2cc1f30ff6032899ca80eed29fa26b8898c54
cve.org/CVERecord?id=CVE-2017-14955