CVE-2019-13273

CRITICAL

Xymon < 4.3.28 - Buffer Overflow in csvinfo CGI Script via srcdb Parameter

Title source: llm

Description

In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that triggers an sprintf of the srcdb parameter.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c

View Writeup ZIP pw:eip

Mailing List, Third Party Advisory x_refsource_confirm

https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html

Scores

CVSS v3 9.8

EPSS 0.0153

EPSS Percentile 71.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (2)

debian/debian_linux 8.0

xymon/xymon < 4.3.28

Published Aug 27, 2019

Tracked Since Feb 18, 2026