← Vulnerability feed

Vulnerability record · CVE-2013-3506 · published 8 May 2013

CVE-2013-3506: Gwos groundwork monitor permissions and access controls vulnerability

Gwos · Groundwork Monitor

cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.

7.5 CVSS 2.0 High EPSS 2.5% · top 15.9% CWE-264 · Permissions and access controls
7.5CVSS 2.0 base score
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
16 Jun 2026Last modified by NVD

Description

cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.kb.cert.org/vuls/id/345260 US Government Resource
https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critica
http://www.kb.cert.org/vuls/id/345260 US Government Resource
https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critica

Track CVE-2013-3506 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2013-3499Gwos groundwork monitor permissions and access controls vulnerabilityGroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which allows remote attackers to obtain administ…EPSS 3.2%7.5CVE-2013-3500Gwos groundwork monitor permissions and access controls vulnerabilityThe Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/…EPSS 2.4%6.8CVE-2013-3513Gwos groundwork monitor cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hij…EPSS 0.72%6.5CVE-2013-3509Gwos groundwork monitor permissions and access controls vulnerabilityhtml/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via…EPSS 1.9%6.5CVE-2013-3510Gwos groundwork monitor sql injection vulnerabilityMultiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via …EPSS 1.3%6.5CVE-2013-3512Gwos groundwork monitor improper input validation vulnerabilityThe Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, which allows remote authenticated users to…EPSS 1.5%6.5CVE-2013-3502GroundWork Monitor monarch_scan.cgi command execution via SSO cookieThe monarch_scan.cgi script in the MONARCH component of GroundWork Monitor Enterprise 6.7.0 fails to properly validate authorization, allowing a remo…EPSS 54%analysed6.5CVE-2013-3508Gwos groundwork monitor code injection vulnerabilityhtml/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated us…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2013-3506), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.