Description
Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x,
and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary
web script or HTML via a status-message, which is not properly handled in
the "detailed status" page, or (2) remote authenticated users to inject
arbitrary web script or HTML via an acknowledgement message, which is not
properly handled in the "status" page.
Package
| Upstream: | released
(4.3.25-1)
|
| Ubuntu 18.04 LTS: | not-affected
(4.3.25-1)
|
| Ubuntu 14.04 ESM: | DNE
(trusty was needed)
|
| Ubuntu 20.04 FIPS Compliant: | not-affected
(4.3.25-1)
|
Patches:
Updated: 2022-04-13 12:13:05 UTC (commit f411bd370d482ef4385c4e751d121a4055fbc009)