XSS in Xymon
CVE-2016-2058
Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the "status" page.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.012 (65.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Xymon — versions 4.1.0, 4.1.1, 4.1.2
- Debian Debian_linux — versions 8.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2016-2058?
- CVE-2016-2058 is a medium-severity vulnerability in Xymon, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2016-04-13.
- How severe is CVE-2016-2058?
- Medium severity. CVSS v3 base score is 5.4 out of 10.