PT-2019-13228 · Xymon+1 · Xymon+1

Published 2019-08-26 · Updated 2019-09-13 · CVE-2019-13274

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xymon versions prior to 4.3.29

Description The issue is related to an XSS vulnerability in the csvinfo CGI script. This vulnerability exists due to insufficient filtering of the db parameter.

Recommendations For versions prior to 4.3.29, update to version 4.3.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the csvinfo CGI script until a patch is available. Avoid using the db parameter in the affected script until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2019-2687

ALT-PU-2019-2690

CVE-2019-13274

DLA-1898-1

Affected Products

Alt Linux

Xymon

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2019-13274 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13274 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13274 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1898-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13274 · Security Note
• https://ubuntu.com/security/CVE-2019-13274 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13274 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-13274 · Vendor Advisory
• https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c · Note
• https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html · Note
• https://lists.xymon.com/archive/2019-July/046570.html · Note