CVE-2016-2058 Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is....
MediumCVSS 5.4
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the "status" page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xymon(Debian:12) | < 4.3.25-1 | 4.3.25-1 |
| debian/xymon(Debian:13) | < 4.3.25-1 | 4.3.25-1 |
| debian/xymon(Debian:14) | < 4.3.25-1 | 4.3.25-1 |
| debian linux | = 8.0 | No fix listed |
| xymon | = 4.1.0 | No fix listed |
| xymon | = 4.1.1 | No fix listed |
| xymon | = 4.1.2 | No fix listed |
| xymon | = 4.1.2-p1 | No fix listed |
| xymon | = 4.1.2-p2 | No fix listed |
| xymon | = 4.2-alfa | No fix listed |
| xymon | = 4.2-beta20060605 | No fix listed |
| xymon | = 4.2-rc20060712 | No fix listed |
| xymon | = 4.2.0 | No fix listed |
| xymon | = 4.2.2 | No fix listed |
| xymon | = 4.2.2-rc1 | No fix listed |
| xymon | = 4.2.3 | No fix listed |
| xymon | = 4.2.3-rc1 | No fix listed |
| xymon | = 4.3.0 | No fix listed |
| xymon | = 4.3.0-beta1 | No fix listed |
| xymon | = 4.3.0-beta2 | No fix listed |
| xymon | = 4.3.0-beta3 | No fix listed |
| xymon | = 4.3.0-rc1 | No fix listed |
| xymon | = 4.3.1 | No fix listed |
| xymon | = 4.3.2 | No fix listed |
| xymon | = 4.3.3 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| xymon | = 4.3.4 | No fix listed |
| xymon | = 4.3.5 | No fix listed |
| xymon | = 4.3.6 | No fix listed |
| xymon | = 4.3.7 | No fix listed |
| xymon | = 4.3.8 | No fix listed |
| xymon | = 4.3.9 | No fix listed |
| xymon | = 4.3.10 | No fix listed |
| xymon | = 4.3.11 | No fix listed |
| xymon | = 4.3.12 | No fix listed |
| xymon | = 4.3.13 | No fix listed |
| xymon | = 4.3.14 | No fix listed |
| xymon | = 4.3.15 | No fix listed |
| xymon | = 4.3.16 | No fix listed |
| xymon | = 4.3.17 | No fix listed |
| xymon | = 4.3.18 | No fix listed |
| xymon | = 4.3.19 | No fix listed |
| xymon | = 4.3.19-rc1 | No fix listed |
| xymon | = 4.3.20 | No fix listed |
| xymon | = 4.3.21 | No fix listed |
| xymon | = 4.3.22 | No fix listed |
| xymon | = 4.3.23 | No fix listed |
| xymon | = 4.3.24 | No fix listed |
References
- Debian Security Tracker CVE-2016-2058 vendor-advisory
- packetstormsecurity.com
- DSA-3495 vendor-advisory
- 20160214 Xymon: Critical security issues in all versions prior to 4.3.25 mailing-list
- sourceforge.net patch