{"id":"CVE-2016-2058","aliases":["DEBIAN-CVE-2016-2058","DLA-488-1","DSA-3495-1","EUVD-2016-3163","GHSA-jq5m-m9q5-jj6q","MGASA-2016-0177","UBUNTU-CVE-2016-2058"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3...","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01217,"percentile":0.68803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-02-28T00:00:00Z","modified":"2026-09-22T07:03:03Z","fixes":[{"ecosystem":"Debian:12","package":"xymon","fixed_in":["4.3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xymon","fixed_in":["4.3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xymon","fixed_in":["4.3.25-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0~beta2.dfsg-9.1+deb7u1"}]}],"versions":["4.3.0~beta2.dfsg-9.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-6+deb8u1"}]}],"versions":["4.3.17-6"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"xymon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-5.1.mga5"}]}],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"xymon","product":"xymon"}],"references":[{"url":"http://www.securityfocus.com/archive/1/537522/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://sourceforge.net/p/xymon/code/7892/","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.debian.org/security/2016/dsa-3495","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2058"},{"url":"https://sourceforge.net/p/xymon/code/7892"},{"url":"https://github.com/advisories/GHSA-jq5m-m9q5-jj6q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2058","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0177.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17846","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3495","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-2058","tags":["report"]},{"url":"http://lists.xymon.com/pipermail/xymon/2016-February/042986.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2058","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-2058","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"published","published":"2016-04-13T16:00:00Z","modified":"2024-08-05T23:17:50.334Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2016-3163","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"published","published":"2016-04-13T16:00:00Z","modified":"2024-08-05T23:17:50Z","updated_at":"2026-11-03T02:22:54.667958Z"}],"ghsa":[{"id":"GHSA-jq5m-m9q5-jj6q","title":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3...","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"published","published":"2022-05-14T02:46:39Z","modified":"2025-04-12T12:59:40Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:26.909163Z"}],"nvd":[{"id":"CVE-2016-2058","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"published","published":"2016-04-13T16:59:08.787Z","modified":"2026-06-17T00:43:21.227Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-2058","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"published","published":"2016-04-13T16:59:08.787Z","modified":"2026-04-16T06:26:08.955775934Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2058","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"published","published":"2016-04-13T16:59:08.787Z","modified":"2026-09-22T07:03:03.771051702Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-2058","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the \"detailed status\" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the \"status\" page.","status":"withdrawn","published":"2016-04-13T16:59:00Z","modified":"2025-07-16T07:17:47.28514Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-488-1","title":"xymon - security update","status":"published","published":"2016-05-25T00:00:00Z","modified":"2026-03-09T02:08:59.278479Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3495-1","title":"xymon - security update","status":"published","published":"2016-02-28T00:00:00Z","modified":"2026-03-09T01:23:37.85866Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0177","title":"Updated xymon packages fix security vulnerabilities","description":"Updated xymon packages fix security vulnerabilities:\n\n\nThe incorrect handling of user-supplied input in the \"config\" command can\ntrigger a stack-based buffer overflow, resulting in denial of service (via\napplication crash) or remote code execution (CVE-2016-2054).\n\nThe incorrect handling of user-supplied input in the \"config\" command can\nlead to an information leak by serving sensitive configuration files to a\nremote user (CVE-2016-2055).\n\nThe commands handling password management do not properly validate\nuser-supplied input, and are thus vulnerable to shell command injection by a\nremote user (CVE-2016-2056).\n\nIncorrect permissions on an internal queuing system allow a user with a local\naccount on the xymon master server to bypass all network-based access control\nlists, and thus inject messages directly into xymon (CVE-2016-2057).\n\nIncorrect escaping of user-supplied input in status webpages can be used to\ntrigger reflected cross-site scripting attacks (CVE-2016-2058).\n\nNote that to effectively fix CVE-2016-2055, the /etc/xymon/xymonpasswd\nconfiguration file should be owned by user and group apache with 640\npermissions.\n","status":"published","published":"2016-05-18T20:14:22Z","modified":"2026-04-16T06:22:54.265759658Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}