← Back

CVE-2013-4173

nvd nist
Published: Oct 11, 2013Modified: Apr 29, 2026

JSON object

Loading...
5.0
Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P
Exploitability: 10.0 / Impact: 2.9
Source: NVD

Description

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Affected (13)

Products: Xymon: Xymon
Xymon
1 product
Xymon
Configuration A
13 vulnerable
Vulnerable SoftwareAffected Versions
Xymon
Xymon
Up to 4.3.1
Xymon
Version 4.0.1
Xymon
Version 4.0.2
Xymon
Version 4.0.3
Xymon
Version 4.0.4
Xymon
Version 4.0
Xymon
Version 4.1.0
Xymon
Version 4.1.1
Xymon
Version 4.1.2
Xymon
Version 4.2.0
Xymon
Version 4.2.2
Xymon
Version 4.2.3
Xymon
Version 4.3.0

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (6)

Source: secalert@redhat.com
Patch
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.