CVE-2016-7067

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Tildeslash Ltd.	monit	5.20.0

References

http://www.securityfocus.com/bid/93953Third Party Advisory, VDB Entry
https://bitbucket.org/tildeslash/monit/commits/c6ec3820e627f85417053e6336de2987f2d863e3?at=masterExploit, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7067Issue Tracking, Third Party Advisory
https://seclists.org/oss-sec/2016/q4/267Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/93953Third Party Advisory, VDB Entry
https://bitbucket.org/tildeslash/monit/commits/c6ec3820e627f85417053e6336de2987f2d863e3?at=masterExploit, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7067Issue Tracking, Third Party Advisory
https://seclists.org/oss-sec/2016/q4/267Mailing List, Third Party Advisory

Timeline

Published: Sep 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70687.5An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticate CVE-2016-70697.5An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist CVE-2016-70708.0A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures CVE-2016-70718.8It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote CVE-2016-70727.5An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a deni CVE-2016-70735.9An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-CVE-2016-70745.9An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-CVE-2016-70758.1It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fi CVE-2016-70767.8sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C libra CVE-2016-70774.3foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated CVE-2016-70784.3foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_CVE-2016-70797.8The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial