Path Traversal in Xymon

CVE-2013-4173

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.028 (85.2th percentile) — read the EPSS interpretation.

Affected products

Xymon — versions 4.0, 4.0.1, 4.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)