CVE-2016-2055: Infoleak
Published Apr 13, 2016
·Updated
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.
Affected Software
44 affected components
Xymon xymon=4.1.0
Xymon xymon=4.1.1
Xymon xymon=4.1.2
Xymon xymon=4.1.2-p1
Xymon xymon=4.1.2-p2
Xymon xymon=4.2-alfa
Xymon xymon=4.2-beta20060605
Xymon xymon=4.2-rc20060712
Xymon xymon=4.2.0
Xymon xymon=4.2.2
Xymon xymon=4.2.2-rc1
Xymon xymon=4.2.3
Xymon xymon=4.2.3-rc1
Xymon xymon=4.3.0
Xymon xymon=4.3.0-beta1
Xymon xymon=4.3.0-beta2
Xymon xymon=4.3.0-beta3
Xymon xymon=4.3.0-rc1
Xymon xymon=4.3.1
Xymon xymon=4.3.2
Xymon xymon=4.3.3
Xymon xymon=4.3.4
Xymon xymon=4.3.5
Xymon xymon=4.3.6
Xymon xymon=4.3.7
Xymon xymon=4.3.8
Xymon xymon=4.3.9
Xymon xymon=4.3.10
Xymon xymon=4.3.11
Xymon xymon=4.3.12
Xymon xymon=4.3.13
Xymon xymon=4.3.14
Xymon xymon=4.3.15
Xymon xymon=4.3.16
Xymon xymon=4.3.17
Xymon xymon=4.3.18
Xymon xymon=4.3.19
Xymon xymon=4.3.19-rc1
Xymon xymon=4.3.20
Xymon xymon=4.3.21
Xymon xymon=4.3.22
Xymon xymon=4.3.23
Xymon xymon=4.3.24
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Apr 13, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2055?
CVE-2016-2055 is classified as a medium severity vulnerability due to its potential for unauthorized file access.
2
How do I fix CVE-2016-2055?
To mitigate CVE-2016-2055, upgrade to Xymon version 4.3.25 or later, which contains the necessary security patches.
3
What impact does CVE-2016-2055 have on Xymon users?
CVE-2016-2055 allows remote attackers to read arbitrary files from the configuration directory, posing a significant risk to sensitive information.
4
Which versions of Xymon are affected by CVE-2016-2055?
Xymon versions 4.1.x, 4.2.x, and 4.3.x prior to 4.3.25 are vulnerable to CVE-2016-2055.
5
Can CVE-2016-2055 be exploited remotely?
Yes, CVE-2016-2055 can be exploited remotely through the vulnerable 'config' command in Xymon.