← Vulnerability feed

Vulnerability record · CVE-2013-3509 · published 8 May 2013

CVE-2013-3509: Gwos groundwork monitor permissions and access controls vulnerability

Gwos · Groundwork Monitor

html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu.

6.5 CVSS 2.0 Medium EPSS 1.9% · top 21.2% CWE-264 · Permissions and access controls
6.5CVSS 2.0 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
16 Jun 2026Last modified by NVD

Description

html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu.

AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.kb.cert.org/vuls/id/345260 US Government Resource
https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_ri
http://www.kb.cert.org/vuls/id/345260 US Government Resource
https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_ri

Track CVE-2013-3509 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2013-3499Gwos groundwork monitor permissions and access controls vulnerabilityGroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer header, which allows remote attackers to obtain administ…EPSS 3.2%7.5CVE-2013-3500Gwos groundwork monitor permissions and access controls vulnerabilityThe Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/…EPSS 2.4%7.5CVE-2013-3506Gwos groundwork monitor permissions and access controls vulnerabilitycgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which a…EPSS 2.5%6.8CVE-2013-3513Gwos groundwork monitor cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hij…EPSS 0.72%6.5CVE-2013-3510Gwos groundwork monitor sql injection vulnerabilityMultiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via …EPSS 1.3%6.5CVE-2013-3512Gwos groundwork monitor improper input validation vulnerabilityThe Cacti component in GroundWork Monitor Enterprise 6.7.0 does not properly perform authorization checks, which allows remote authenticated users to…EPSS 1.5%6.5CVE-2013-3502GroundWork Monitor monarch_scan.cgi command execution via SSO cookieThe monarch_scan.cgi script in the MONARCH component of GroundWork Monitor Enterprise 6.7.0 fails to properly validate authorization, allowing a remo…EPSS 54%analysed6.5CVE-2013-3508Gwos groundwork monitor code injection vulnerabilityhtml/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated us…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2013-3509), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.