CVE Feed

    Dashboard / CVE / CVE-2013-3503

    CVE-2013-3503

    The Profile Importer feature in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    Published:May 8, 2013
    Last Modified:Apr 11, 2025
    EPS:May 8, 2013
    EPSS Score:0.00386
    CVSS Score:3.5

    Affected Products

    Vendor
    Gwos
    Product
    Groundwork Monitor

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2013-3502 (CVSS 6.5) — monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated u…
    CVE-2013-3505 (CVSS 4) — The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to bypass in…
    CVE-2013-3510 (CVSS 6.5) — Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users…
    CVE-2013-3513 (CVSS 6.8) — Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterpr…
    CVE-2013-3512 (CVSS 6.5) — The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, whi…
    CVE-2013-3499 (CVSS 7.5) — GroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which all…
    CVE-2013-3500 (CVSS 7.5) — The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the ow…
    CVE-2013-3501 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attack…
    CVE-2013-3504 (CVSS 5.5) — Directory traversal vulnerability in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7…
    CVE-2013-3506 (CVSS 7.5) — cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High