CVE-2016-2056

high · 8.8

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.

8.8

CVSS

54.5%

EPSS (exploit prob.)

99th

EPSS percentile

2016-04-13

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
xymon	xymon	4.1.0
xymon	xymon	4.1.1
xymon	xymon	4.1.2
xymon	xymon	4.1.2
xymon	xymon	4.1.2
xymon	xymon	4.2
xymon	xymon	4.2
xymon	xymon	4.2
xymon	xymon	4.2.0
xymon	xymon	4.2.2
xymon	xymon	4.2.2
xymon	xymon	4.2.3
xymon	xymon	4.2.3
xymon	xymon	4.3.0
xymon	xymon	4.3.0
xymon	xymon	4.3.0
xymon	xymon	4.3.0
xymon	xymon	4.3.0
xymon	xymon	4.3.1
xymon	xymon	4.3.2
xymon	xymon	4.3.3
xymon	xymon	4.3.4
xymon	xymon	4.3.5
xymon	xymon	4.3.6
xymon	xymon	4.3.7
xymon	xymon	4.3.8
xymon	xymon	4.3.9
xymon	xymon	4.3.10
xymon	xymon	4.3.11
xymon	xymon	4.3.12
xymon	xymon	4.3.13
xymon	xymon	4.3.14
xymon	xymon	4.3.15
xymon	xymon	4.3.16
xymon	xymon	4.3.17
xymon	xymon	4.3.18
xymon	xymon	4.3.19
xymon	xymon	4.3.19
xymon	xymon	4.3.20
xymon	xymon	4.3.21

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-2056