Welcome to the Monitorix project
Take control over your small server
News
13-Nov-2015
This is a maintenance release that mainly fixes a Document Object Model (DOM)-based cross-site scripting (XSS) vulnerability in themonitorix.cgi
file. Such vulnerability is by injection a JS code in the when
parameter of the URL shown after generating the graphs. Additionally, a potential denial of service (DoS) issue was discovered in the same when
parameter of the URL which could lead in the creation of an enormous amount of .png files in the imgs
directory of the server.
These vulnerabilities are due to a lack of precise input validation on user-supplied data within the DOM input. A remote attacker could exploit these vulnerabilities by sending crafted URLs that contain malicious DOM statements to the affected system.
This new version also adds support for ZFS versions older than 0.6.4 and adds a new option called extra_args
in the NTP module to be able to include extra arguments to the command ntpq -pn
executed by Monitorix.
The rest of changes and bugs fixed are, as always, reflected in the Changes
file.
All users still using older versions are advised and encouraged to upgrade to this version, which resolves these security issues.