CVE Feed

    Dashboard / CVE / CVE-2013-3502

    CVE-2013-3502

    monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and consequently obtain sensitive information, by leveraging a JOSSO SSO cookie.

    Published:May 8, 2013
    Last Modified:Apr 11, 2025
    EPS:May 8, 2013
    EPSS Score:0.51138
    CVSS Score:6.5

    Affected Products

    Vendor
    Gwos
    Product
    Groundwork Monitor

    Exploits

    https://www.exploit-db.com/exploits/25001

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2013-3505 (CVSS 4) — The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to bypass in…
    CVE-2013-3510 (CVSS 6.5) — Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users…
    CVE-2013-3513 (CVSS 6.8) — Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterpr…
    CVE-2013-3512 (CVSS 6.5) — The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, whi…
    CVE-2013-3499 (CVSS 7.5) — GroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which all…
    CVE-2013-3500 (CVSS 7.5) — The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the ow…
    CVE-2013-3501 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attack…
    CVE-2013-3504 (CVSS 5.5) — Directory traversal vulnerability in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7…
    CVE-2013-3506 (CVSS 7.5) — cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not…
    CVE-2013-3507 (CVSS 4) — The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitiv…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High