Read the docs
TI-2013-03437 Aliases CVE-2013-3935GHSA-6m33-h785-xxg4

Cross-site request forgery in Opsview

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.

Why it matters now

EPSS 0.00542 45th percentileScored 2026-11-07
Fix Fixed Opsview (Opsview): 4.4.1Opsview Core (Opsview): 20130522

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpsviewOpsviewbefore 4.4.14.4.1Patch availableCNA
OpsviewOpsview Corebefore 2013052220130522Patch availableCNA
  • Opsview VendorOpsview Affected before 4.4.1 Fixed in 4.4.1 Patch available CNA
  • Opsview Core VendorOpsview Affected before 20130522 Fixed in 20130522 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opsview:opsview:*:*:*:*:*:*:*:*before 4.4.1VulnerableOpsview
cpe:2.3:a:opsview:opsview_core:*:*:*:*:*:*:*:*before 20130522VulnerableOpsview
  • cpe:2.3:a:opsview:opsview:*:*:*:*:*:*:*:* Versions before 4.4.1 Vulnerable ·Opsview
  • cpe:2.3:a:opsview:opsview_core:*:*:*:*:*:*:*:* Versions before 20130522 Vulnerable ·Opsview

Remediation

  • Fix · CNA Opsview (Opsview) Fixed in 4.4.1
  • Fix · CNA Opsview Core (Opsview) Fixed in 20130522

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-3935
  2. 2026-10-03 Alias added: GHSA-6m33-h785-xxg4

References

Other 2

  • TI-2018-11543 The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1… CVSS 3.0CRITICAL 9.8
  • TI-2016-08418 In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to… CVSS 3.0HIGH 7.5
  • TI-2018-11545 The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality… CVSS 3.0HIGH 7.2
  • TI-2018-11544 The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor… CVSS 3.0HIGH 8.1
  • TI-2013-04849 SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows… CVSS 2.0HIGH 7.5
  • TI-2016-08419 Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to… CVSS 3.0MEDIUM 6.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences