Read the docs
TI-2013-03438 Aliases CVE-2013-3936GHSA-3m2g-j7xq-ffgx

Cross-site scripting in Opsview

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to inject arbitrary web script or HTML.

Why it matters now

EPSS 0.00772 55th percentileScored 2026-11-07
Fix Fixed Opsview (Opsview): 4.4.1Opsview Core (Opsview): 20130522

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpsviewOpsviewbefore 4.4.14.4.1Patch availableCNA
OpsviewOpsview Corebefore 2013052220130522Patch availableCNA
  • Opsview VendorOpsview Affected before 4.4.1 Fixed in 4.4.1 Patch available CNA
  • Opsview Core VendorOpsview Affected before 20130522 Fixed in 20130522 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opsview:opsview:*:*:*:*:*:*:*:*before 4.4.1VulnerableOpsview
cpe:2.3:a:opsview:opsview_core:*:*:*:*:*:*:*:*before 20130522VulnerableOpsview
  • cpe:2.3:a:opsview:opsview:*:*:*:*:*:*:*:* Versions before 4.4.1 Vulnerable ·Opsview
  • cpe:2.3:a:opsview:opsview_core:*:*:*:*:*:*:*:* Versions before 20130522 Vulnerable ·Opsview

Remediation

  • Fix · CNA Opsview (Opsview) Fixed in 4.4.1
  • Fix · CNA Opsview Core (Opsview) Fixed in 20130522

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-3936
  2. 2026-10-03 Alias added: GHSA-3m2g-j7xq-ffgx

References

Advisory 2

  • TI-2018-11543 The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1… CVSS 3.0CRITICAL 9.8
  • TI-2016-08418 In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to… CVSS 3.0HIGH 7.5
  • TI-2018-11545 The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality… CVSS 3.0HIGH 7.2
  • TI-2018-11544 The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor… CVSS 3.0HIGH 8.1
  • TI-2013-03437 Cross-site request forgery in Opsview CVSS 3.1HIGH 8.8
  • TI-2013-04849 SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows… CVSS 2.0HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences