Lucene search

MitreCVE-2016-2058

HistoryApr 13, 2016 - 4:59 p.m.

CVE-2016-2058

2016-04-1316:59:08

CWE-79

mitre

web.nvd.nist.gov

xss

cross-site scripting

xymon

vulnerability

remote clients

injection

web script

html

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

35.0%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the “detailed status” page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the “status” page.

Affected configurations

Nvd

Node

debiandebian_linuxMatch8.0

Node

xymonxymonMatch4.1.0

xymonxymonMatch4.1.1

xymonxymonMatch4.1.2

xymonxymonMatch4.1.2p1

xymonxymonMatch4.1.2p2

xymonxymonMatch4.2alfa

xymonxymonMatch4.2beta20060605

xymonxymonMatch4.2rc20060712

xymonxymonMatch4.2.0

xymonxymonMatch4.2.2

xymonxymonMatch4.2.2rc1

xymonxymonMatch4.2.3

xymonxymonMatch4.2.3rc1

xymonxymonMatch4.3.0

xymonxymonMatch4.3.0beta1

xymonxymonMatch4.3.0beta2

xymonxymonMatch4.3.0beta3

xymonxymonMatch4.3.0rc1

xymonxymonMatch4.3.1

xymonxymonMatch4.3.2

xymonxymonMatch4.3.3

xymonxymonMatch4.3.4

xymonxymonMatch4.3.5

xymonxymonMatch4.3.6

xymonxymonMatch4.3.7

xymonxymonMatch4.3.8

xymonxymonMatch4.3.9

xymonxymonMatch4.3.10

xymonxymonMatch4.3.11

xymonxymonMatch4.3.12

xymonxymonMatch4.3.13

xymonxymonMatch4.3.14

xymonxymonMatch4.3.15

xymonxymonMatch4.3.16

xymonxymonMatch4.3.17

xymonxymonMatch4.3.18

xymonxymonMatch4.3.19

xymonxymonMatch4.3.19rc1

xymonxymonMatch4.3.20

xymonxymonMatch4.3.21

xymonxymonMatch4.3.22

xymonxymonMatch4.3.23

xymonxymonMatch4.3.24

VendorProductVersionCPE
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
xymonxymon4.1.0cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:*
xymonxymon4.1.1cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:*
xymonxymon4.1.2cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:*
xymonxymon4.1.2cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:*
xymonxymon4.1.2cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:*
xymonxymon4.2cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:*
xymonxymon4.2cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:*
xymonxymon4.2cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:*
xymonxymon4.2.0cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
xymon	xymon	4.1.0	cpe:2.3:a:xymon:xymon:4.1.0:::::::*
xymon	xymon	4.1.1	cpe:2.3:a:xymon:xymon:4.1.1:::::::*
xymon	xymon	4.1.2	cpe:2.3:a:xymon:xymon:4.1.2:::::::*
xymon	xymon	4.1.2	cpe:2.3:a:xymon:xymon:4.1.2:p1::::::
xymon	xymon	4.1.2	cpe:2.3:a:xymon:xymon:4.1.2:p2::::::
xymon	xymon	4.2	cpe:2.3:a:xymon:xymon:4.2:alfa::::::
xymon	xymon	4.2	cpe:2.3:a:xymon:xymon:4.2:beta20060605::::::
xymon	xymon	4.2	cpe:2.3:a:xymon:xymon:4.2:rc20060712::::::
xymon	xymon	4.2.0	cpe:2.3:a:xymon:xymon:4.2.0:::::::*