CVE-2016-2058: XSS

Published Apr 13, 2016

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the "status" page.

Affected Software

44 affected components

Debian Debian Linux=8.0

Xymon xymon=4.1.0

Xymon xymon=4.1.1

Xymon xymon=4.1.2

Xymon xymon=4.1.2-p1

Xymon xymon=4.1.2-p2

Xymon xymon=4.2-alfa

Xymon xymon=4.2-beta20060605

Xymon xymon=4.2-rc20060712

Xymon xymon=4.2.0

Xymon xymon=4.2.2

Xymon xymon=4.2.2-rc1

Xymon xymon=4.2.3

Xymon xymon=4.2.3-rc1

Xymon xymon=4.3.0

Xymon xymon=4.3.0-beta1

Xymon xymon=4.3.0-beta2

Xymon xymon=4.3.0-beta3

Xymon xymon=4.3.0-rc1

Xymon xymon=4.3.1

Xymon xymon=4.3.2

Xymon xymon=4.3.3

Xymon xymon=4.3.4

Xymon xymon=4.3.5

Xymon xymon=4.3.6

Xymon xymon=4.3.7

Xymon xymon=4.3.8

Xymon xymon=4.3.9

Xymon xymon=4.3.10

Xymon xymon=4.3.11

Xymon xymon=4.3.12

Xymon xymon=4.3.13

Xymon xymon=4.3.14

Xymon xymon=4.3.15

Xymon xymon=4.3.16

Xymon xymon=4.3.17

Xymon xymon=4.3.18

Xymon xymon=4.3.19

Xymon xymon=4.3.19-rc1

Xymon xymon=4.3.20

Xymon xymon=4.3.21

Xymon xymon=4.3.22

Xymon xymon=4.3.23

Xymon xymon=4.3.24

Remediation

Patch Available

https://sourceforge.net/p/xymon/code/7892/

Event History

Apr 13, 2016

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2058?

CVE-2016-2058 has a medium severity rating due to its potential to allow remote users to execute arbitrary scripts.

How do I fix CVE-2016-2058?

To fix CVE-2016-2058, upgrade Xymon to version 4.3.25 or later, which addresses the vulnerability.

What are the affected versions of Xymon in CVE-2016-2058?

CVE-2016-2058 affects Xymon versions 4.1.x, 4.2.x, and 4.3.x prior to 4.3.25.

Can users exploit CVE-2016-2058 without authentication?

Yes, CVE-2016-2058 can be exploited by unauthenticated remote Xymon clients through status messages.

Is there a workaround for CVE-2016-2058?

While upgrading to a patched version is recommended, restricting access to the detailed status page can serve as a temporary workaround.