CVE Feed

    Dashboard / CVE / CVE-2013-3506

    CVE-2013-3506

    cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.

    Published:May 8, 2013
    Last Modified:Apr 11, 2025
    EPS:May 8, 2013
    EPSS Score:0.00926
    CVSS Score:7.5

    Affected Products

    Vendor
    Gwos
    Product
    Groundwork Monitor

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2013-3502 (CVSS 6.5) — monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated u…
    CVE-2013-3505 (CVSS 4) — The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to bypass in…
    CVE-2013-3510 (CVSS 6.5) — Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users…
    CVE-2013-3513 (CVSS 6.8) — Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterpr…
    CVE-2013-3512 (CVSS 6.5) — The Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, whi…
    CVE-2013-3499 (CVSS 7.5) — GroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which all…
    CVE-2013-3500 (CVSS 7.5) — The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the ow…
    CVE-2013-3501 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attack…
    CVE-2013-3504 (CVSS 5.5) — Directory traversal vulnerability in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7…
    CVE-2013-3507 (CVSS 4) — The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitiv…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High