Xymon monitor cross-site scripting vulnerabilities

2011.04.20
Credit: Henrik Storner
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2011-1716
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Several cross-site scripting vulnerabilities have been identified in the Xymon systems- and network-monitoring tool available at http://sourceforge.net/projects/xymon/ All versions prior to 4.3.1 (released April 3, 2011) are vulnerable. I would like to thank David Ferrest for notifying me of this issue. Henrik Størner, lead Xymon developer.

References:

http://xymon.svn.sourceforge.net/viewvc/xymon/branches/4.3.2/Changes?revision=6673&view=markup
http://xforce.iss.net/xforce/xfdb/66542
http://www.securityfocus.com/bid/47156
http://www.securityfocus.com/archive/1/archive/1/517325/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/517316/100/0/threaded
http://secunia.com/advisories/44036
http://osvdb.org/71489


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top