{"id":"CVE-2013-4173","aliases":["DEBIAN-CVE-2013-4173","EUVD-2013-4097","GHSA-27g7-g6jx-rvq6","MGASA-2013-0243"],"status":"published","title":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3...","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02829,"percentile":0.86697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2013-08-11T12:20:08Z","modified":"2026-09-01T20:03:17Z","fixes":[{"ecosystem":"Debian:12","package":"xymon","fixed_in":["4.3.17-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xymon","fixed_in":["4.3.17-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xymon","fixed_in":["4.3.17-2"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"xymon","fixed_in":["4.2.3-11.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"xymon","fixed_in":["4.2.3-14.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-2"}]}]},{"source":"osv","ecosystem":"Mageia:2","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-11.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-14.mga3"}]}]}],"products":[{"vendor":"xymon","product":"xymon"}],"references":[{"url":"http://sourceforge.net/projects/xymon/files/Xymon/4.3.12/","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2013/07/27/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:213","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4173"},{"url":"http://sourceforge.net/projects/xymon/files/Xymon/4.3.12"},{"url":"https://github.com/advisories/GHSA-27g7-g6jx-rvq6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4173","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0243.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10874","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2013/07/27/3","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4173","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","status":"published","published":"2013-10-11T22:00:00Z","modified":"2024-09-16T23:27:07.747Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4097","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","status":"published","published":"2013-10-11T22:00:00Z","modified":"2024-09-16T23:27:07Z","updated_at":"2026-11-03T00:54:50.364031Z"}],"ghsa":[{"id":"GHSA-27g7-g6jx-rvq6","title":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3...","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","status":"published","published":"2022-05-17T05:00:36Z","modified":"2025-04-11T04:15:49Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:01:14.923786Z"}],"nvd":[{"id":"CVE-2013-4173","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","status":"published","published":"2013-10-11T22:55:39.707Z","modified":"2026-06-16T23:56:45.35Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"CVE-2013-4173","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","status":"published","published":"2013-10-11T22:55:39Z","modified":"2026-04-16T06:24:19.173504275Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4173","description":"Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a \"drophost\" command.","status":"published","published":"2013-10-11T22:55:39.707Z","modified":"2026-09-01T20:03:17.491843123Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0243","title":"Updated xymon package fixes security vulnerability.","description":"A security vulnerability has been found in version 4.x of the\nXymon Systems \u0026 Network Monitor tool \n\nThe error permits a remote attacker to delete files on the server\nrunning the Xymon trend-data daemon \"xymond_rrd\".\nFile deletion is done with the privileges of the user that Xymon is\nrunning with, so it is limited to files available to the userid\nrunning the Xymon service. This includes all historical data stored\nby the Xymon monitoring system. (CVE-2013-4173)\n","status":"published","published":"2013-08-11T12:20:08Z","modified":"2026-04-16T06:25:03.98675657Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}