medium6.1
CVE-2019-13274
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
Impact
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xymon | Xymon | through 4.3.28 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c
- https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html
- https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c
- https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html