Every CVESearch/Get API key

CVE-2013-4173

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3...

5.0 MediumFix available

CVE-2013-4173 is a medium vulnerability (CVSS 5.0) in Xymon, published August 11, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in xymon 4.3.17-2.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
2.83%EPSS, 86th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.3.17-2xymon +4 more

Description

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Exploit likelihood

2.83%Up 1.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xymon
Debian:12
before 4.3.17-2
4.3.17-2
xymon
Debian:13
before 4.3.17-2
4.3.17-2
xymon
Debian:14
before 4.3.17-2
4.3.17-2
xymon
Mageia:2
before 4.2.3-11.mga2
4.2.3-11.mga2
xymon
Mageia:3
before 4.2.3-14.mga3
4.2.3-14.mga3

What each source reports

NVD Score used5.0

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Record
CVE-2013-4173
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-22
Updated
2026-11-02
CVE ListNo score

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Record
CVE-2013-4173
Updated
2026-11-02
EUVDEUVD-2013-4097No score

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Record
EUVD-2013-4097
Updated
2026-11-03
GitHub AdvisoriesGHSA-27g7-g6jx-rvq6No score

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3...

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Record
GHSA-27g7-g6jx-rvq6
Weakness
CWE-22
Updated
2026-11-02
OSVNo score

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Record
CVE-2013-4173
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4173No score

Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.

Record
DEBIAN-CVE-2013-4173
Updated
2026-11-02
OSVMGASA-2013-0243No score

Updated xymon package fixes security vulnerability.

A security vulnerability has been found in version 4.x of the Xymon Systems & Network Monitor tool

The error permits a remote attacker to delete files on the server running the Xymon trend-data daemon "xymond_rrd". File deletion is done with the privileges of the user that Xymon is running with, so it is limited to files available to the userid running the Xymon service. This includes all historical data stored by the Xymon monitoring system. (CVE-2013-4173)

Record
MGASA-2013-0243
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open