CVE-2019-13274
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to...
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
CVE-2019-13274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
CVE-2019-13274- Updated
- 2026-11-02
EUVDEUVD-2019-4781 No score
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
EUVD-2019-4781- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23f8-vj3q-65w6
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to...
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
GHSA-23f8-vj3q-65w6- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
CVE-2019-13274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13274
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
DEBIAN-CVE-2019-13274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13274
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- Record
UBUNTU-CVE-2019-13274- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xymonDebian:12 |
before 4.3.29-1 | 4.3.29-1 |
xymonDebian:13 |
before 4.3.29-1 | 4.3.29-1 |
xymonDebian:14 |
before 4.3.29-1 | 4.3.29-1 |
xymonDebian:8 |
before 4.3.17-6+deb8u2, plus listed versions 4.3.17-64.3.17-6+deb8u1 |
4.3.17-6+deb8u2 |
xymonUbuntu:16.04:LTS |
All versions, plus listed versions 4.3.21-14.3.21-24.3.22~beta-14.3.24-14.3.24-24.3.25-1 |
None known |
xymonUbuntu:18.04:LTS |
All versions, plus listed versions 4.3.28-24.3.28-34.3.28-3build1 |
None known |
xymonUbuntu:20.04:LTS |
before 4.3.29-1 | 4.3.29-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13274 is a medium vulnerability (CVSS 6.1) in Xymon, published August 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 59th percentile. Fixed in xymon 4.3.29-1.
References
github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c
lists.debian.org/debian-lts-announce/2019/08/msg00032.html
nvd.nist.gov/vuln/detail/CVE-2019-13274
security-tracker.debian.org/tracker/CVE-2019-13274
ubuntu.com/security/CVE-2019-13274
lists.xymon.com/archive/2019-July/046570.html
cve.org/CVERecord?id=CVE-2019-13274