NetSight
IP …
high8.8Public exploit code

CVE-2016-2056

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_na…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.

Affected products

VendorProductAffected versions
XymonXymon
Versions 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.2
DebianDebian Linux
Version 8.0

Weakness classification

CWE-77

References